From: Christopher Faulet <cfaulet@haproxy.com>
Date: Wed, 28 Feb 2018 12:33:26 +0000 (+0100)
Subject: BUG/MEDIUM: spoe: Remove idle applets from idle list when HAProxy is stopping
X-Git-Tag: v1.9-dev1~401
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7d9f1ba246055046eed547fa35aa546683021dce;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: spoe: Remove idle applets from idle list when HAProxy is stopping

In the SPOE applet's handler, when an applet is switched from the state IDLE to
PROCESSING, it is removed for the list of idle applets. But when HAProxy is
stopping, this applet can be switched to DISCONNECT. In this case, we also need
to remove it from the list of idle applets. Else the applet is removed but still
present in the list. It could lead to a segmentation fault or an infinite loop,
depending the code path.
---

diff --git a/src/flt_spoe.c b/src/flt_spoe.c
index a53795861f..a701c70745 100644
--- a/src/flt_spoe.c
+++ b/src/flt_spoe.c
@@ -1843,6 +1843,8 @@ spoe_handle_appctx(struct appctx *appctx)
 			goto switchstate;
 
 		case SPOE_APPCTX_ST_IDLE:
+			SPOE_DEBUG_STMT(agent->rt[tid].applets_idle--);
+			eb32_delete(&SPOE_APPCTX(appctx)->node);
 			if (stopping &&
 			    LIST_ISEMPTY(&agent->rt[tid].sending_queue) &&
 			    LIST_ISEMPTY(&SPOE_APPCTX(appctx)->waiting_queue)) {
@@ -1851,8 +1853,6 @@ spoe_handle_appctx(struct appctx *appctx)
 				appctx->st0 = SPOE_APPCTX_ST_DISCONNECT;
 				goto switchstate;
 			}
-			SPOE_DEBUG_STMT(agent->rt[tid].applets_idle--);
-			eb32_delete(&SPOE_APPCTX(appctx)->node);
 			appctx->st0 = SPOE_APPCTX_ST_PROCESSING;
 			/* fall through */