From: Aurelien DARRAGON <adarragon@haproxy.com>
Date: Tue, 13 Jan 2026 18:15:07 +0000 (+0100)
Subject: BUG/MINOR: server: ensure server is detached from proxy list before being freed
X-Git-Tag: v3.4-dev3~25
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d38b918da1c8deece731e2fba36576f0b077ed76;p=thirdparty%2Fhaproxy.git

BUG/MINOR: server: ensure server is detached from proxy list before being freed

There remained some cases (on error paths) were a server could be freed
while still attached on the parent proxy server list. In 3.3 this can be
problematic because new_server() automatically adds the server to the
parent proxy list.

The bug is insignificant because it is on errors paths during init and
often haproxy exits right after. But let's fix that to ensure no UAF or
undefined behavior occurs because of that.

This patch depends on ("MINOR: cli: use srv_drop() when server was created using new_server()")

It must be backported in 3.3 with the above mentioned patch.
---

diff --git a/src/cli.c b/src/cli.c
index ebf47cea7..1d187da67 100644
--- a/src/cli.c
+++ b/src/cli.c
@@ -3737,8 +3737,10 @@ int mworker_cli_attach_server(char **errmsg)
 
 error:
 
-	list_for_each_entry(child, &proc_list, list)
+	list_for_each_entry(child, &proc_list, list) {
+		srv_detach(child->srv);
 		srv_drop(child->srv);
+	}
 	free(msg);
 
 	return -1;
diff --git a/src/server.c b/src/server.c
index a86047fdf..db098a800 100644
--- a/src/server.c
+++ b/src/server.c
@@ -3433,6 +3433,7 @@ static int _srv_parse_tmpl_init(struct server *srv, struct proxy *px)
 		free_check(&newsrv->agent);
 		free_check(&newsrv->check);
 		MT_LIST_DELETE(&newsrv->global_list);
+		srv_detach(newsrv);
 	}
 	srv_drop(newsrv);
 	return i - srv->tmpl_info.nb_low;