From: Olivier Houchard <cognet@ci0.org>
Date: Mon, 25 Feb 2019 15:18:16 +0000 (+0100)
Subject: BUG/MAJOR: listener: Make sure the listener exist before using it.
X-Git-Tag: v2.0-dev1~17
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d16a9dfed80e75d730754b717370515265698cdd;p=thirdparty%2Fhaproxy.git

BUG/MAJOR: listener: Make sure the listener exist before using it.

In listener_accept(), make sure we have a listener before attempting to
use it.
An another thread may have closed the FD meanwhile, and set fdtab[fd].owner
to NULL.
As the listener is not free'd, it is ok to attempt to accept() a new
connection even if the listener was closed. At worst the fd has been
reassigned to another connection, and accept() will fail anyway.

Many thanks to Richard Russo for reporting the problem, and suggesting the
fix.

This should be backported to 1.9 and 1.8.
---

diff --git a/src/listener.c b/src/listener.c
index e9ace41f52..4d080310d1 100644
--- a/src/listener.c
+++ b/src/listener.c
@@ -448,8 +448,8 @@ void delete_listener(struct listener *listener)
 void listener_accept(int fd)
 {
 	struct listener *l = fdtab[fd].owner;
-	struct proxy *p = l->bind_conf->frontend;
-	int max_accept = l->maxaccept ? l->maxaccept : 1;
+	struct proxy *p;
+	int max_accept;
 	int expire;
 	int cfd;
 	int ret;
@@ -457,6 +457,10 @@ void listener_accept(int fd)
 	static int accept4_broken;
 #endif
 
+	if (!l)
+		return;
+	p = l->bind_conf->frontend;
+	max_accept = l->maxaccept ? l->maxaccept : 1;
 	if (HA_SPIN_TRYLOCK(LISTENER_LOCK, &l->lock))
 		return;