commit 83af1f6b65806982640679823228976deebf5202 Author: Willy Tarreau Date: Tue Apr 30 11:43:43 2019 +0200 BUG/MAJOR: map/acl: real fix segfault during show map/acl on CLI A previous commit 8d85aa44d ("BUG/MAJOR: map: fix segfault during 'show map/acl' on cli.") was provided to address a concurrency issue between "show acl" and "clear acl" on the CLI. Sadly the code placed there was copy-pasted without changing the element type (which was struct stream in the original code) and not tested since the crash is still present. The reproducer is simple : load a large ACL file (e.g. geolocation addresses), issue "show acl #0" in loops in one window and issue a "clear acl #0" in the other one, haproxy crashes. This fix was also tested with threads enabled and looks good since the locking seems to work correctly in these areas though. It will have to be backported as far as 1.6 since the commit above went that far as well... (cherry picked from commit 49ee3b2f9a9e5d0b8d394938df527aa645ce72b4) Signed-off-by: Willy Tarreau (cherry picked from commit ac4be10f62ef72962d9cf0e6f2619e1e1c370d62) Signed-off-by: Christopher Faulet diff --git a/src/pattern.c b/src/pattern.c index 7eea9d96..21639569 100644 --- a/src/pattern.c +++ b/src/pattern.c @@ -1651,7 +1651,7 @@ int pat_ref_delete_by_id(struct pat_ref *ref, struct pat_ref_elt *refelt) LIST_DEL(&bref->users); LIST_INIT(&bref->users); if (elt->list.n != &ref->head) - LIST_ADDQ(&LIST_ELEM(elt->list.n, struct stream *, list)->back_refs, &bref->users); + LIST_ADDQ(&LIST_ELEM(elt->list.n, typeof(elt), list)->back_refs, &bref->users); bref->ref = elt->list.n; } list_for_each_entry(expr, &ref->pat, list) @@ -1691,7 +1691,7 @@ int pat_ref_delete(struct pat_ref *ref, const char *key) LIST_DEL(&bref->users); LIST_INIT(&bref->users); if (elt->list.n != &ref->head) - LIST_ADDQ(&LIST_ELEM(elt->list.n, struct stream *, list)->back_refs, &bref->users); + LIST_ADDQ(&LIST_ELEM(elt->list.n, typeof(elt), list)->back_refs, &bref->users); bref->ref = elt->list.n; } list_for_each_entry(expr, &ref->pat, list) @@ -2086,7 +2086,7 @@ void pat_ref_reload(struct pat_ref *ref, struct pat_ref *replace) LIST_DEL(&bref->users); LIST_INIT(&bref->users); if (elt->list.n != &ref->head) - LIST_ADDQ(&LIST_ELEM(elt->list.n, struct stream *, list)->back_refs, &bref->users); + LIST_ADDQ(&LIST_ELEM(elt->list.n, typeof(elt), list)->back_refs, &bref->users); bref->ref = elt->list.n; } LIST_DEL(&elt->list); @@ -2175,7 +2175,7 @@ void pat_ref_prune(struct pat_ref *ref) LIST_DEL(&bref->users); LIST_INIT(&bref->users); if (elt->list.n != &ref->head) - LIST_ADDQ(&LIST_ELEM(elt->list.n, struct stream *, list)->back_refs, &bref->users); + LIST_ADDQ(&LIST_ELEM(elt->list.n, typeof(elt), list)->back_refs, &bref->users); bref->ref = elt->list.n; } LIST_DEL(&elt->list);