From: Willy Tarreau <w@1wt.eu>
Date: Wed, 22 Nov 2017 15:53:53 +0000 (+0100)
Subject: BUG/MEDIUM: deinit: correctly deinitialize the proxy and global listener tasks
X-Git-Tag: v1.8.0~63
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1f89b1805b308df51a1329aea9a81d2ba55dfedc;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: deinit: correctly deinitialize the proxy and global listener tasks

While using mmap() to allocate pools for debugging purposes, kill -USR1 caused
libc aborts in deinit() on two calls to free() on proxies' tasks and the global
listener task. The issue comes from the fact that we're using free() to release
a task instead of task_free(), so the task was allocated from a pool and released
using a different method.

This bug has been there since at least 1.5, so a backport is desirable to all
maintained versions.
---

diff --git a/src/haproxy.c b/src/haproxy.c
index 4596dbded3..dca2a3392c 100644
--- a/src/haproxy.c
+++ b/src/haproxy.c
@@ -2181,7 +2181,7 @@ void deinit(void)
 
 		free_http_req_rules(&p->http_req_rules);
 		free_http_res_rules(&p->http_res_rules);
-		free(p->task);
+		task_free(p->task);
 
 		pool_destroy2(p->req_cap_pool);
 		pool_destroy2(p->rsp_cap_pool);
@@ -2228,7 +2228,7 @@ void deinit(void)
 	free(global.node);    global.node = NULL;
 	free(global.desc);    global.desc = NULL;
 	free(oldpids);        oldpids = NULL;
-	free(global_listener_queue_task); global_listener_queue_task = NULL;
+	task_free(global_listener_queue_task); global_listener_queue_task = NULL;
 
 	list_for_each_entry_safe(log, logb, &global.logsrvs, list) {
 			LIST_DEL(&log->list);