BUG/MEDIUM: fd: Use the provided tgid in fd_insert() to get tgroup_info

In fd_insert(), use the provided tgid to ghet the thread group info,
instead of using the one of the current thread, as we may call
fd_insert() from a thread of another thread group, that will happen at
least when binding the listeners. Otherwise we'd end up accessing the
thread mask containing enabled thread of the wrong thread group, which
can lead to crashes if we're binding on threads not present in the
thread group.
This should fix Github issue #2991.

This should be backported up to 2.8.

diff --git a/include/haproxy/fd.h b/include/haproxy/fd.h
index 2912b72886003ab4b9cca3c3ef09f9e7c14db680..029883d087ed9c6d6c3478c5c4b7f924a548f9e7 100644 (file)
--- a/include/haproxy/fd.h
+++ b/include/haproxy/fd.h
@@ -499,6 +499,7 @@ static inline long fd_clr_running(int fd)
 static inline void fd_insert(int fd, void *owner, void (*iocb)(int fd), int tgid, unsigned long thread_mask)
 {
        extern void sock_conn_iocb(int);
+       struct tgroup_info *tginfo = &ha_tgroup_info[tgid - 1];
        int newstate;
 
        /* conn_fd_handler should support edge-triggered FDs */
@@ -528,7 +529,7 @@ static inline void fd_insert(int fd, void *owner, void (*iocb)(int fd), int tgid
        BUG_ON(fdtab[fd].state != 0);
        BUG_ON(tgid < 1 || tgid > MAX_TGROUPS);
 
-       thread_mask &= tg->threads_enabled;
+       thread_mask &= tginfo->threads_enabled;
        BUG_ON(thread_mask == 0);
 
        fd_claim_tgid(fd, tgid);