]> git.ipfire.org Git - thirdparty/haproxy.git/commitdiff
BUG/MINOR: sink: invalid sft free in sink_deinit()
authorAurelien DARRAGON <adarragon@haproxy.com>
Mon, 10 Jul 2023 13:17:12 +0000 (15:17 +0200)
committerChristopher Faulet <cfaulet@haproxy.com>
Mon, 10 Jul 2023 16:28:08 +0000 (18:28 +0200)
sft freeing attempt made in a575421 ("BUG/MINOR: sink: missing sft free in
sink_deinit()") is incomplete, because sink->sft is meant to be used as a
list and not a single sft entry.

Because of that, the previous fix only frees the first sft entry, which
fixes memory leaks for single-server forwarders (this is the case for
implicit rings), but could still result in memory leaks when multiple
servers are configured in a explicit ring sections.

What this patch does: instead of directly freeing sink->sft, it iterates
over every list members to free them.

It must be backported up to 2.4 with a575421.

src/sink.c

index 00a2d34642a40ed37fced69891632b28e655e2b1..3cf7fcaee56869e46b27d7e3ab42a46a3f8ad30e 100644 (file)
@@ -1356,6 +1356,7 @@ static void sink_init()
 static void sink_deinit()
 {
        struct sink *sink, *sb;
+       struct sink_forward_target *sft_next;
 
        list_for_each_entry_safe(sink, sb, &sink_list, sink_list) {
                if (sink->type == SINK_TYPE_BUFFER) {
@@ -1375,7 +1376,11 @@ static void sink_deinit()
                free_proxy(sink->forward_px);
                free(sink->name);
                free(sink->desc);
-               free(sink->sft);
+               while (sink->sft) {
+                       sft_next = sink->sft->next;
+                       free(sink->sft);
+                       sink->sft = sft_next;
+               }
                free(sink);
        }
 }