You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

53 lines
1.8 KiB

  1. From b94a6d5a37499ce6649ad58f4a8c4664779abd8b Mon Sep 17 00:00:00 2001
  2. From: Willy Tarreau <w@1wt.eu>
  3. Date: Wed, 13 May 2015 11:38:17 +0200
  4. Subject: [PATCH 5/8] BUG/MEDIUM: checks: do not dereference head of a
  5. tcp-check at the end
  6. When the end of the list is reached, the current step's action is checked
  7. to know if we must poll or not. Unfortunately, the main reason for going
  8. there is that we walked past the end of list and current_step points to
  9. the head. We cannot dereference ->action since it does not belong to this
  10. structure and can definitely crash if the address is not mapped.
  11. This bug is unlikely to cause a crash since the action appears just after
  12. the list, and corresponds to the "char *check_req" pointer in the proxy
  13. struct, and it seems that we can't go there with current_step being null.
  14. At worst it can cause the check to register for recv events.
  15. This fix needs to be backported to 1.5 since the code is incorrect there
  16. as well.
  17. (cherry picked from commit 53c5a049e1f4dbf67412472e23690dc6b3c8d0f8)
  18. ---
  19. src/checks.c | 5 +++--
  20. 1 file changed, 3 insertions(+), 2 deletions(-)
  21. diff --git a/src/checks.c b/src/checks.c
  22. index cfdfe8c..a887be1 100644
  23. --- a/src/checks.c
  24. +++ b/src/checks.c
  25. @@ -2237,10 +2237,12 @@ static void tcpcheck_main(struct connection *conn)
  26. goto out_end_tcpcheck;
  27. out_need_io:
  28. + /* warning, current_step may now point to the head */
  29. if (check->bo->o)
  30. __conn_data_want_send(conn);
  31. - if (check->current_step->action == TCPCHK_ACT_EXPECT)
  32. + if (&check->current_step->list != head &&
  33. + check->current_step->action == TCPCHK_ACT_EXPECT)
  34. __conn_data_want_recv(conn);
  35. return;
  36. @@ -2256,7 +2258,6 @@ static void tcpcheck_main(struct connection *conn)
  37. conn->flags |= CO_FL_ERROR;
  38. __conn_data_stop_both(conn);
  39. -
  40. return;
  41. }
  42. --
  43. 2.0.5