From: Dragan Dosen <ddosen@haproxy.com>
Date: Fri, 7 Aug 2026 11:08:45 +0000 (+0000)
Subject: BUG/MEDIUM: fd: release the port range entry in host byte order
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e088b0d8e38738ce5cc19a4e3fd44b3d3599c6f5;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: fd: release the port range entry in host byte order

The port recovered with getsockname() in _fd_delete_orphan() was given
back to the port range without being converted to host byte order. The
range then fills up with byte-swapped values which are handed out on the
next pass. Both TCP and QUIC are affected.

It is now released using get_host_port(), which takes care of the
conversion for both address families.

The issue was introduced with commit 02b7685013 ("MEDIUM: fd: Remove
fdinfo").

No backport needed.
---

diff --git a/src/fd.c b/src/fd.c
index 7e106654e..60dbb1a85 100644
--- a/src/fd.c
+++ b/src/fd.c
@@ -352,11 +352,8 @@ void _fd_delete_orphan(int fd)
 		 * to figure out what the port was.
 		 */
 		BUG_ON(getsockname(fd, (struct sockaddr *)&sa, &addrlen) != 0);
-		if (sa.ss_family == AF_INET)
-			port = ((struct sockaddr_in *)&sa)->sin_port;
-		else if (sa.ss_family == AF_INET6)
-			port = ((struct sockaddr_in6 *)&sa)->sin6_port;
-		else
+		port = get_host_port(&sa);
+		if (!port)
 			ABORT_NOW();
 		port_range_release_port(fdtab[fd].owner, port);
 	}