From: Christopher Faulet <cfaulet@haproxy.com>
Date: Thu, 4 Jul 2019 09:59:42 +0000 (+0200)
Subject: BUG/MEDIUM: lb_fas: Don't test the server's lb_tree from outside the lock
X-Git-Tag: v2.1-dev1~30
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=16b2be93ad9e7db2d57ca5aaa4ca629efecd6530;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: lb_fas: Don't test the server's lb_tree from outside the lock

In the function fas_srv_reposition(), the server's lb_tree is tested from
outside the lock. So it is possible to remove it after the test and then call
eb32_insert() in fas_queue_srv() with a NULL root pointer, which is
invalid. Moving the test in the scope of the lock fixes the bug.

This issue was reported on Github, issue #126.

This patch must be backported to 2.0, 1.9 and 1.8.
---

diff --git a/src/lb_fas.c b/src/lb_fas.c
index 69b85d72df..6b72099f3d 100644
--- a/src/lb_fas.c
+++ b/src/lb_fas.c
@@ -70,12 +70,11 @@ static inline void fas_queue_srv(struct server *s)
  */
 static void fas_srv_reposition(struct server *s)
 {
-	if (!s->lb_tree)
-		return;
-
 	HA_SPIN_LOCK(LBPRM_LOCK, &s->proxy->lbprm.lock);
-	fas_dequeue_srv(s);
-	fas_queue_srv(s);
+	if (s->lb_tree) {
+		fas_dequeue_srv(s);
+		fas_queue_srv(s);
+	}
 	HA_SPIN_UNLOCK(LBPRM_LOCK, &s->proxy->lbprm.lock);
 }