You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
64 lines
2.7 KiB
64 lines
2.7 KiB
From ab45181e36b6c4f7d31c5284035937c2d0be37eb Mon Sep 17 00:00:00 2001
|
|
From: Willy Tarreau <w@1wt.eu>
|
|
Date: Mon, 31 Oct 2016 17:46:57 +0100
|
|
Subject: [PATCH 26/26] BUG/MEDIUM: peers: fix use after free in
|
|
peer_session_create()
|
|
|
|
In case of resource allocation error, peer_session_create() frees
|
|
everything allocated and returns a pointer to the stream/session that
|
|
was put back into the free pool. This stream/session is then assigned
|
|
to ps->{stream,session} with no error control. This means that it is
|
|
perfectly possible to have a new stream or session being both used for
|
|
a regular communication and for a peer at the same time.
|
|
|
|
In fact it is the only way (for now) to explain a CLOSE_WAIT on peers
|
|
connections that was caught in this dump with the stream interface in
|
|
SI_ST_CON state while the error field proves the state ought to have
|
|
been SI_ST_DIS, very likely indicating two concurrent accesses on the
|
|
same area :
|
|
|
|
0x7dbd50: [31/Oct/2016:17:53:41.267510] id=0 proto=tcpv4
|
|
flags=0x23006, conn_retries=0, srv_conn=(nil), pend_pos=(nil)
|
|
frontend=myhost2 (id=4294967295 mode=tcp), listener=? (id=0)
|
|
backend=<NONE> (id=-1 mode=-) addr=127.0.0.1:41432
|
|
server=<NONE> (id=-1) addr=127.0.0.1:8521
|
|
task=0x7dbcd8 (state=0x08 nice=0 calls=2 exp=<NEVER> age=1m5s)
|
|
si[0]=0x7dbf48 (state=CLO flags=0x4040 endp0=APPCTX:0x7d99c8 exp=<NEVER>, et=0x000)
|
|
si[1]=0x7dbf68 (state=CON flags=0x50 endp1=CONN:0x7dc0b8 exp=<NEVER>, et=0x020)
|
|
app0=0x7d99c8 st0=11 st1=0 st2=0 applet=<PEER>
|
|
co1=0x7dc0b8 ctrl=tcpv4 xprt=RAW data=STRM target=PROXY:0x7fe62028a010
|
|
flags=0x0020b310 fd=7 fd.state=22 fd.cache=0 updt=0
|
|
req=0x7dbd60 (f=0x80a020 an=0x0 pipe=0 tofwd=0 total=0)
|
|
an_exp=<NEVER> rex=<NEVER> wex=<NEVER>
|
|
buf=0x78a3c0 data=0x78a3d4 o=0 p=0 req.next=0 i=0 size=0
|
|
res=0x7dbda0 (f=0x80402020 an=0x0 pipe=0 tofwd=0 total=0)
|
|
an_exp=<NEVER> rex=<NEVER> wex=<NEVER>
|
|
buf=0x78a3c0 data=0x78a3d4 o=0 p=0 rsp.next=0 i=0 size=0
|
|
|
|
Special thanks to Arnaud Gavara who provided lots of valuable input and
|
|
ran some validation testing on this patch.
|
|
|
|
This fix must be backported to 1.6 and 1.5. Note that in 1.5 the
|
|
session is not assigned from within the function so some extra checks
|
|
may be needed in the callers.
|
|
(cherry picked from commit b21d08e2492bfbf9d2341ce9f148cb9845927862)
|
|
---
|
|
src/peers.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/src/peers.c b/src/peers.c
|
|
index db1f608..c8be59a 100644
|
|
--- a/src/peers.c
|
|
+++ b/src/peers.c
|
|
@@ -1747,7 +1747,7 @@ static struct stream *peer_session_create(struct peers *peers, struct peer *peer
|
|
out_free_appctx:
|
|
appctx_free(appctx);
|
|
out_close:
|
|
- return s;
|
|
+ return NULL;
|
|
}
|
|
|
|
/*
|
|
--
|
|
2.7.3
|
|
|