From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Thu, 28 Jan 2021 09:16:29 +0000 (+0100)
Subject: BUG/MINOR: backend: hold correctly lock when killing idle conn
X-Git-Tag: v2.4-dev8~78
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a3bf62ec541479531ebe93bde46b436cb95c9a87;p=thirdparty%2Fhaproxy.git

BUG/MINOR: backend: hold correctly lock when killing idle conn

The wrong lock seems to be held when trying to remove another thread
connection if max fd limit has been reached (locking the current thread
instead of the target thread lock).

This could be backported up to 2.0.
---

diff --git a/src/backend.c b/src/backend.c
index f6afde358d..7a1d179683 100644
--- a/src/backend.c
+++ b/src/backend.c
@@ -1350,22 +1350,23 @@ int connect_server(struct stream *s)
 				// see it possibly larger.
 				ALREADY_CHECKED(i);
 
-				HA_SPIN_LOCK(OTHER_LOCK, &idle_conns[tid].takeover_lock);
+				HA_SPIN_LOCK(OTHER_LOCK, &idle_conns[i].takeover_lock);
 				tokill_conn = MT_LIST_POP(&srv->idle_conns[i],
 				    struct connection *, list);
 				if (!tokill_conn)
 					tokill_conn = MT_LIST_POP(&srv->safe_conns[i],
 					    struct connection *, list);
+
 				if (tokill_conn) {
 					/* We got one, put it into the concerned thread's to kill list, and wake it's kill task */
 
 					MT_LIST_ADDQ(&idle_conns[i].toremove_conns,
 					    (struct mt_list *)&tokill_conn->list);
 					task_wakeup(idle_conns[i].cleanup_task, TASK_WOKEN_OTHER);
-					HA_SPIN_UNLOCK(OTHER_LOCK, &idle_conns[tid].takeover_lock);
+					HA_SPIN_UNLOCK(OTHER_LOCK, &idle_conns[i].takeover_lock);
 					break;
 				}
-				HA_SPIN_UNLOCK(OTHER_LOCK, &idle_conns[tid].takeover_lock);
+				HA_SPIN_UNLOCK(OTHER_LOCK, &idle_conns[i].takeover_lock);
 			}
 		}