BUG/MINOR: server: ensure server is detached from proxy list before being freed

There remained some cases (on error paths) were a server could be freed
while still attached on the parent proxy server list. In 3.3 this can be
problematic because new_server() automatically adds the server to the
parent proxy list.

The bug is insignificant because it is on errors paths during init and
often haproxy exits right after. But let's fix that to ensure no UAF or
undefined behavior occurs because of that.

This patch depends on ("MINOR: cli: use srv_drop() when server was created using new_server()")

It must be backported in 3.3 with the above mentioned patch.

diff --git a/src/cli.c b/src/cli.c
index ebf47cea709521866ea0ad6d990083f52a08e457..1d187da672a06a0c66abddd38cfde7af3ba02678 100644 (file)
--- a/src/cli.c
+++ b/src/cli.c
@@ -3737,8 +3737,10 @@ int mworker_cli_attach_server(char **errmsg)
 
 error:
 
-       list_for_each_entry(child, &proc_list, list)
+       list_for_each_entry(child, &proc_list, list) {
+               srv_detach(child->srv);
                srv_drop(child->srv);
+       }
        free(msg);
 
        return -1;

diff --git a/src/server.c b/src/server.c
index a86047fdfc6ed83841c89f0846db611c84176486..db098a800c2270b3852eefb84fb0152bce48bf2f 100644 (file)
--- a/src/server.c
+++ b/src/server.c
@@ -3433,6 +3433,7 @@ static int _srv_parse_tmpl_init(struct server *srv, struct proxy *px)
                free_check(&newsrv->agent);
                free_check(&newsrv->check);
                MT_LIST_DELETE(&newsrv->global_list);
+               srv_detach(newsrv);
        }
        srv_drop(newsrv);
        return i - srv->tmpl_info.nb_low;