BUG/MEDIUM: spoe: Remove idle applets from idle list when HAProxy is stopping

In the SPOE applet's handler, when an applet is switched from the state IDLE to
PROCESSING, it is removed for the list of idle applets. But when HAProxy is
stopping, this applet can be switched to DISCONNECT. In this case, we also need
to remove it from the list of idle applets. Else the applet is removed but still
present in the list. It could lead to a segmentation fault or an infinite loop,
depending the code path.

diff --git a/src/flt_spoe.c b/src/flt_spoe.c
index a53795861faf0ce3bd8b83ec2833a1c7cdf7da3b..a701c70745e74413e3e56bbd612c643b9a4a57a8 100644 (file)
--- a/src/flt_spoe.c
+++ b/src/flt_spoe.c
@@ -1843,6 +1843,8 @@ spoe_handle_appctx(struct appctx *appctx)
                        goto switchstate;
 
                case SPOE_APPCTX_ST_IDLE:
+                       SPOE_DEBUG_STMT(agent->rt[tid].applets_idle--);
+                       eb32_delete(&SPOE_APPCTX(appctx)->node);
                        if (stopping &&
                            LIST_ISEMPTY(&agent->rt[tid].sending_queue) &&
                            LIST_ISEMPTY(&SPOE_APPCTX(appctx)->waiting_queue)) {
@@ -1851,8 +1853,6 @@ spoe_handle_appctx(struct appctx *appctx)
                                appctx->st0 = SPOE_APPCTX_ST_DISCONNECT;
                                goto switchstate;
                        }
-                       SPOE_DEBUG_STMT(agent->rt[tid].applets_idle--);
-                       eb32_delete(&SPOE_APPCTX(appctx)->node);
                        appctx->st0 = SPOE_APPCTX_ST_PROCESSING;
                        /* fall through */