From: Christopher Faulet <cfaulet@haproxy.com>
Date: Thu, 20 Jul 2023 12:53:50 +0000 (+0200)
Subject: BUG/MEDIUM: listener: Acquire proxy's lock in relax_listener() if necessary
X-Git-Tag: v2.9-dev2~18
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ff1c803279cfc8bdee8f2e13798cd3e4d99762c0;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: listener: Acquire proxy's lock in relax_listener() if necessary

Listener functions must follow a common locking pattern:

  1. Get the proxy's lock if necessary
  2. Get the protocol's lock if necessary
  3. Get the listener's lock if necessary

We must take care to respect this order to avoid any ABBA issue. However, an
issue was introduced in the commit bcad7e631 ("MINOR: listener: add
relax_listener() function"). relax_listener() gets the lisener's lock and if
resume_listener() is called, the proxy's lock is then acquired.

So to fix the issue, the proxy's lock is first acquired in relax_listener(),
if necessary.

This patch should fix the issue #2222. It must be backported as far as 2.4
because the above commit is marked to be backported there.
---

diff --git a/src/listener.c b/src/listener.c
index a1160da76f..70d13ea843 100644
--- a/src/listener.c
+++ b/src/listener.c
@@ -633,18 +633,26 @@ int resume_listener(struct listener *l, int lpx, int lli)
  */
 int relax_listener(struct listener *l, int lpx, int lli)
 {
+	struct proxy *px = l->bind_conf->frontend;
 	int ret = 1;
 
+	if (!lpx && px)
+		HA_RWLOCK_WRLOCK(PROXY_LOCK, &px->lock);
+
 	if (!lli)
 		HA_RWLOCK_WRLOCK(LISTENER_LOCK, &l->lock);
 
 	if (l->state != LI_FULL && l->state != LI_LIMITED)
 		goto end; /* listener may be suspended or even stopped */
-	ret = resume_listener(l, lpx, 1);
+	ret = resume_listener(l, 1, 1);
 
  end:
 	if (!lli)
 		HA_RWLOCK_WRUNLOCK(LISTENER_LOCK, &l->lock);
+
+	if (!lpx && px)
+		HA_RWLOCK_WRUNLOCK(PROXY_LOCK, &px->lock);
+
 	return ret;
 }