BUG/MINOR: listener: null pointer dereference suspected by coverity

Please refer to GH #1859 for more info.
Coverity suspected improper proxy pointer handling.
Without the fix it is considered safe for the moment, but it might not
be the case in the future as we want to keep the ability to have
isolated listeners.

Making sure stop_listener(), pause_listener(), resume_listener()
and listener_release() functions make proper use
of px pointer in that context.

No need for backport except if multi-connection protocols (ie:FTP)
were to be backported as well.

diff --git a/src/listener.c b/src/listener.c
index b4b4d3d27a7875986f1c70ad65695fd1ac2549d2..412af94a160662aa11802dd58512c6410c9b56da 100644 (file)
--- a/src/listener.c
+++ b/src/listener.c
@@ -350,7 +350,7 @@ void stop_listener(struct listener *l, int lpx, int lpr)
                return;
        }
 
-       if (!lpx)
+       if (!lpx && px)
                HA_RWLOCK_WRLOCK(PROXY_LOCK, &px->lock);
 
        if (!lpr)
@@ -364,7 +364,8 @@ void stop_listener(struct listener *l, int lpx, int lpr)
                if (l->state >= LI_ASSIGNED)
                        __delete_listener(l);
 
-               proxy_cond_disable(px);
+               if (px)
+                       proxy_cond_disable(px);
        }
 
        HA_RWLOCK_WRUNLOCK(LISTENER_LOCK, &l->lock);
@@ -372,7 +373,7 @@ void stop_listener(struct listener *l, int lpx, int lpr)
        if (!lpr)
                HA_SPIN_UNLOCK(PROTO_LOCK, &proto_lock);
 
-       if (!lpx)
+       if (!lpx && px)
                HA_RWLOCK_WRUNLOCK(PROXY_LOCK, &px->lock);
 }
 
@@ -465,7 +466,7 @@ int pause_listener(struct listener *l, int lpx)
        struct proxy *px = l->bind_conf->frontend;
        int ret = 1;
 
-       if (!lpx)
+       if (!lpx && px)
                HA_RWLOCK_WRLOCK(PROXY_LOCK, &px->lock);
 
        HA_RWLOCK_WRLOCK(LISTENER_LOCK, &l->lock);
@@ -489,7 +490,7 @@ int pause_listener(struct listener *l, int lpx)
   end:
        HA_RWLOCK_WRUNLOCK(LISTENER_LOCK, &l->lock);
 
-       if (!lpx)
+       if (!lpx && px)
                HA_RWLOCK_WRUNLOCK(PROXY_LOCK, &px->lock);
 
        return ret;
@@ -514,7 +515,7 @@ int resume_listener(struct listener *l, int lpx)
        int was_paused = px && px->li_paused;
        int ret = 1;
 
-       if (!lpx)
+       if (!lpx && px)
                HA_RWLOCK_WRLOCK(PROXY_LOCK, &px->lock);
 
        HA_RWLOCK_WRLOCK(LISTENER_LOCK, &l->lock);
@@ -550,7 +551,7 @@ int resume_listener(struct listener *l, int lpx)
   end:
        HA_RWLOCK_WRUNLOCK(LISTENER_LOCK, &l->lock);
 
-       if (!lpx)
+       if (!lpx && px)
                HA_RWLOCK_WRUNLOCK(PROXY_LOCK, &px->lock);
 
        return ret;
@@ -1240,7 +1241,7 @@ void listener_release(struct listener *l)
        /* Dequeues all of the listeners waiting for a resource */
        dequeue_all_listeners();
 
-       if (!MT_LIST_ISEMPTY(&fe->listener_queue) &&
+       if (fe && !MT_LIST_ISEMPTY(&fe->listener_queue) &&
            (!fe->fe_sps_lim || freq_ctr_remain(&fe->fe_sess_per_sec, fe->fe_sps_lim, 0) > 0))
                dequeue_proxy_listeners(fe);
 }