BUG/MEDIUM: deinit: correctly deinitialize the proxy and global listener tasks

While using mmap() to allocate pools for debugging purposes, kill -USR1 caused
libc aborts in deinit() on two calls to free() on proxies' tasks and the global
listener task. The issue comes from the fact that we're using free() to release
a task instead of task_free(), so the task was allocated from a pool and released
using a different method.

This bug has been there since at least 1.5, so a backport is desirable to all
maintained versions.

diff --git a/src/haproxy.c b/src/haproxy.c
index 4596dbded3b218b68e40f4679e3357bf1702340d..dca2a3392c573bc5c10dbf15e8ee0b8bd797736a 100644 (file)
--- a/src/haproxy.c
+++ b/src/haproxy.c
@@ -2181,7 +2181,7 @@ void deinit(void)
 
                free_http_req_rules(&p->http_req_rules);
                free_http_res_rules(&p->http_res_rules);
-               free(p->task);
+               task_free(p->task);
 
                pool_destroy2(p->req_cap_pool);
                pool_destroy2(p->rsp_cap_pool);
@@ -2228,7 +2228,7 @@ void deinit(void)
        free(global.node);    global.node = NULL;
        free(global.desc);    global.desc = NULL;
        free(oldpids);        oldpids = NULL;
-       free(global_listener_queue_task); global_listener_queue_task = NULL;
+       task_free(global_listener_queue_task); global_listener_queue_task = NULL;
 
        list_for_each_entry_safe(log, logb, &global.logsrvs, list) {
                        LIST_DEL(&log->list);