From: Aurelien DARRAGON <adarragon@haproxy.com>
Date: Wed, 24 Jul 2024 13:45:50 +0000 (+0200)
Subject: BUG/MEDIUM: sink: properly init applet under sft lock
X-Git-Tag: v3.1-dev4~11
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c81b8ee480f7e55809b56b369cfea1bf36879e67;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: sink: properly init applet under sft lock

Since 09d69eacf8 ("MEDIUM: sink: start applets asynchronously") the applet
is no longer initialized under the sft lock while it was the case before.

At first it doesn't seem to be an issue, but if we look closer at
sink_forward_session_init(), we can see that sft->appctx is assigned
while it can be accessed at the same time from sink_init_forward().

Let's restore the old guarantees by performing the .init under the sft
lock.

No backport needed unless 09d69eacf8 is.
---

diff --git a/src/sink.c b/src/sink.c
index 594ddf4650..194bd064ec 100644
--- a/src/sink.c
+++ b/src/sink.c
@@ -495,6 +495,11 @@ static int sink_forward_session_init(struct appctx *appctx)
 	struct stream *s;
 	struct sockaddr_storage *addr = NULL;
 
+	/* sft init is performed asynchronously so <sft> must be manipulated
+	 * under the lock
+	 */
+	HA_SPIN_LOCK(SFT_LOCK, &sft->lock);
+
 	if (!sockaddr_alloc(&addr, &sft->srv->addr, sizeof(sft->srv->addr)))
 		goto out_error;
 	/* srv port should be learned from srv->svc_port not from srv->addr */
@@ -516,11 +521,14 @@ static int sink_forward_session_init(struct appctx *appctx)
 	applet_expect_no_data(appctx);
 	sft->appctx = appctx;
 
+	HA_SPIN_UNLOCK(SFT_LOCK, &sft->lock);
+
 	return 0;
 
  out_free_addr:
 	sockaddr_free(&addr);
  out_error:
+	HA_SPIN_UNLOCK(SFT_LOCK, &sft->lock);
 	return -1;
 }