From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Mon, 17 May 2021 08:47:18 +0000 (+0200)
Subject: BUG/MAJOR: server: prevent deadlock when using 'set maxconn server'
X-Git-Tag: v2.5-dev1~249
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=79a88ba3d09f7e2b73ae27cb5d24cc087a548fa6;p=thirdparty%2Fhaproxy.git

BUG/MAJOR: server: prevent deadlock when using 'set maxconn server'

A deadlock is possible with 'set maxconn server' command, if there is
pending connection ready to be dequeued. This is caused by the locking
of server spinlock in both cli_parse_set_maxconn_server and
process_srv_queue.

Fix this by reducing the scope of the server lock into
server_parse_maxconn_change_request. If connection are dequeued, the
lock is taken a second time. This can be seen as suboptimal but as it
happens only during 'set maxconn server' it can be considered as
tolerable.

This issue was reported on the mailing list, for the 1.8.x branch.
It must be backported up to the 1.8.
---

diff --git a/src/server.c b/src/server.c
index fa1d9d6c6e..49bd5450b7 100644
--- a/src/server.c
+++ b/src/server.c
@@ -1800,11 +1800,13 @@ const char *server_parse_maxconn_change_request(struct server *sv,
 	else if (end[0] != '\0')
 		return "Trailing garbage in maxconn string";
 
+	HA_SPIN_LOCK(SERVER_LOCK, &sv->lock);
 	if (sv->maxconn == sv->minconn) { // static maxconn
 		sv->maxconn = sv->minconn = v;
 	} else { // dynamic maxconn
 		sv->maxconn = v;
 	}
+	HA_SPIN_UNLOCK(SERVER_LOCK, &sv->lock);
 
 	if (may_dequeue_tasks(sv, sv->proxy))
 		process_srv_queue(sv);
@@ -4141,14 +4143,10 @@ static int cli_parse_set_maxconn_server(char **args, char *payload, struct appct
 	if (!sv)
 		return 1;
 
-	HA_SPIN_LOCK(SERVER_LOCK, &sv->lock);
-
 	warning = server_parse_maxconn_change_request(sv, args[4]);
 	if (warning)
 		cli_err(appctx, warning);
 
-	HA_SPIN_UNLOCK(SERVER_LOCK, &sv->lock);
-
 	return 1;
 }