From: Willy Tarreau <w@1wt.eu>
Date: Mon, 25 Jul 2022 13:39:21 +0000 (+0200)
Subject: BUG/MAJOR: poller: drop FD's tgid when masks don't match
X-Git-Tag: v2.7-dev3~69
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=698342635491a30b219bebeb1bbe7877efdbe3b6;p=thirdparty%2Fhaproxy.git

BUG/MAJOR: poller: drop FD's tgid when masks don't match

A bug was introduced in 2.7-dev2 by commit 1f947cb39 ("MAJOR: poller:
only touch/inspect the update_mask under tgid protection"): once the
FD's tgid is held, we would forget to drop it in case the update mask
doesn't match, resulting in random watchdog panics of older processes
on successive reloads.

This should fix issue #1798. Thanks to Christian for the report and
to Christopher for the reproducer.

No backport is needed.
---

diff --git a/src/ev_epoll.c b/src/ev_epoll.c
index f35e1c29be..970c0fe705 100644
--- a/src/ev_epoll.c
+++ b/src/ev_epoll.c
@@ -204,8 +204,10 @@ static void _do_poll(struct poller *p, int exp, int wake)
 			continue;
 		}
 
-		if (!(fdtab[fd].update_mask & ti->ltid_bit))
+		if (!(fdtab[fd].update_mask & ti->ltid_bit)) {
+			fd_drop_tgid(fd);
 			continue;
+		}
 
 		done_update_polling(fd);
 
diff --git a/src/ev_evports.c b/src/ev_evports.c
index 19d572c663..2530b39c04 100644
--- a/src/ev_evports.c
+++ b/src/ev_evports.c
@@ -160,8 +160,10 @@ static void _do_poll(struct poller *p, int exp, int wake)
 			continue;
 		}
 
-		if (!(fdtab[fd].update_mask & ti->ltid_bit))
+		if (!(fdtab[fd].update_mask & ti->ltid_bit)) {
+			fd_drop_tgid(fd);
 			continue;
+		}
 
 		done_update_polling(fd);
 
diff --git a/src/ev_kqueue.c b/src/ev_kqueue.c
index 3d555ec7ef..3c8787ffd7 100644
--- a/src/ev_kqueue.c
+++ b/src/ev_kqueue.c
@@ -134,8 +134,10 @@ static void _do_poll(struct poller *p, int exp, int wake)
 			continue;
 		}
 
-		if (!(fdtab[fd].update_mask & ti->ltid_bit))
+		if (!(fdtab[fd].update_mask & ti->ltid_bit)) {
+			fd_drop_tgid(fd);
 			continue;
+		}
 
 		done_update_polling(fd);