From: Olivier Houchard <ohouchard@haproxy.com>
Date: Thu, 13 Aug 2026 13:57:56 +0000 (+0200)
Subject: BUG/MEDIUM: bwlim: fix a stick-table entry leak in shared mode
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=40c627282d800f8686ad6a57baa2707aa3d59ca0;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: bwlim: fix a stick-table entry leak in shared mode

In shared mode, bwlim_set_limit() stores the stick-table entry returned
by stktable_get_entry(), which takes a reference, into st->ts without
releasing any entry already stored there. When set-bandwidth-limit is
executed more than once for the same stream and shared filter, the
intermediate reference is leaked: bwlim_detach() only releases the last
one. The entry then stays pinned (ref_cnt > 0) and can never be purged,
and with distinct keys the table fills up until the features depending
on it are denied service.

Release the previously held entry before overwriting st->ts.

This was introduced in 2.7 by commit 2b6777021 ("MEDIUM: bwlim: Add
support of bandwith limitation at the stream level") and must be
backported to all stable branches.

Many thanks to Red Hat and AISLE Research for reporting the issue and
providing a fix.
---

diff --git a/src/flt_bwlim.c b/src/flt_bwlim.c
index ebb33a5f1..a7e7a2e83 100644
--- a/src/flt_bwlim.c
+++ b/src/flt_bwlim.c
@@ -402,6 +402,11 @@ static enum act_return bwlim_set_limit(struct act_rule *rule, struct proxy *px,
 		if (!ts)
 			goto end;
 
+		/* release any entry held by a previous execution of the action
+		 * on the same stream, otherwise its reference would be leaked.
+		 */
+		if (st->ts)
+			stktable_touch_local(t, st->ts, 1);
 		st->ts = ts;
 		st->rule = rule;
 	}