]> git.ipfire.org Git - thirdparty/haproxy.git/commitdiff
BUG/MEDIUM: pools: fix ha_free() on area in the process of being freed
authorWilly Tarreau <w@1wt.eu>
Thu, 3 Mar 2022 17:31:54 +0000 (18:31 +0100)
committerWilly Tarreau <w@1wt.eu>
Thu, 3 Mar 2022 17:42:49 +0000 (18:42 +0100)
Commit e81248c0c ("BUG/MINOR: pool: always align pool_heads to 64 bytes")
added a free of the allocated pool in pool_destroy() using ha_free(), but
it added a subtle bug by which once the pool is released, setting its
address to NULL inside the structure itself cannot work because the area
has just been freed.

This will need to be backported wherever the patch above is backported.

src/pool.c

index 441133e7c7c7ebcd5e01270919de2c8018de0c43..b3520d744f156a324638bcc040bdbf171fcbc7e2 100644 (file)
@@ -821,7 +821,7 @@ void *pool_destroy(struct pool_head *pool)
                if (!pool->users) {
                        LIST_DELETE(&pool->list);
                        /* note that if used == 0, the cache is empty */
-                       ha_free(&pool->base_addr);
+                       free(pool->base_addr);
                }
        }
        return NULL;