BUG/MEDIUM: connections: Hold the lock when wanting to kill a connection.

In connect_server(), when we decide we want to kill the connection of
another thread because there are too many idle connections, hold the
toremove_lock of the corresponding thread, othervise, there's a small race
condition where we could try to add the connection to the toremove_connections
list while it has already been free'd.

This should be backported to 2.0 and 2.1.

diff --git a/src/backend.c b/src/backend.c
index ebc5050cb447cc18f3d7fcb515e2ea141bb980a7..be081a5e18ea4e06641d1a105bf49c7aa17d6fc3 100644 (file)
--- a/src/backend.c
+++ b/src/backend.c
@@ -1295,6 +1295,7 @@ int connect_server(struct stream *s)
                                // see it possibly larger.
                                ALREADY_CHECKED(i);
 
+                               HA_SPIN_LOCK(OTHER_LOCK, &toremove_lock[tid]);
                                tokill_conn = MT_LIST_POP(&srv->idle_orphan_conns[i],
                                    struct connection *, list);
                                if (tokill_conn) {
@@ -1305,6 +1306,7 @@ int connect_server(struct stream *s)
                                        task_wakeup(idle_conn_cleanup[i], TASK_WOKEN_OTHER);
                                        break;
                                }
+                               HA_SPIN_UNLOCK(OTHER_LOCK, &toremove_lock[tid]);
                        }
                }