From: Willy Tarreau <w@1wt.eu>
Date: Thu, 19 Jan 2023 16:10:10 +0000 (+0100)
Subject: BUG/MEDIUM: fd/threads: fix again incorrect thread selection in wakeup broadcast
X-Git-Tag: v2.8-dev2~10
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ad90110338f10e464fda81f5cc5421ff31e01cb0;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: fd/threads: fix again incorrect thread selection in wakeup broadcast

Commit c1640f79f ("BUG/MEDIUM: fd/threads: fix incorrect thread selection
in wakeup broadcast") fixed an incorrect range being used to pick a thread
when broadcasting a wakeup for a foreign thread, but the selection was still
wrong as the number of threads and their mask was taken from the current
thread instead of the target thread. In addition, the code dealing with the
wakeup of a thread from the same group was still relying on MAX_THREADS
instead of tg->count.

This could theoretically cause random crashes with more than one thread
group though this was never encountered.

This needs to be backported to 2.7.
---

diff --git a/src/fd.c b/src/fd.c
index 7f1077cd8c..7e56d8a1fe 100644
--- a/src/fd.c
+++ b/src/fd.c
@@ -486,7 +486,8 @@ void updt_fd_polling(const int fd)
 
 		fd_add_to_fd_list(&update_list[tgrp - 1], fd);
 
-		thr = one_among_mask(fdtab[fd].thread_mask & tg->threads_enabled, statistical_prng_range(tg->count));
+		thr = one_among_mask(fdtab[fd].thread_mask & ha_tgroup_info[tgrp - 1].threads_enabled,
+		                     statistical_prng_range(ha_tgroup_info[tgrp - 1].count));
 		thr += ha_tgroup_info[tgrp - 1].base;
 		wake_thread(thr);
 
@@ -515,8 +516,8 @@ void updt_fd_polling(const int fd)
 			 * so let's pick a random one so that it doesn't always end up on the same.
 			 */
 			int thr = one_among_mask(fdtab[fd].thread_mask & tg->threads_enabled,
-			                         statistical_prng_range(MAX_THREADS));
-			thr += ha_tgroup_info[tgid - 1].base;
+			                         statistical_prng_range(tg->count));
+			thr += tg->base;
 			wake_thread(thr);
 		}
 	}