tree d2fbbe047b33f547eb90f77c5345822f6665ef24
parent 4fe7924d63948cdcc58121abfc5e2b799a4a6f51
author Willy Tarreau <w@1wt.eu> 1715790198 +0200
committer Amaury Denoyelle <adenoyelle@haproxy.com> 1718012959 +0200

BUG/MEDIUM: htx: mark htx_sl as packed since it may be realigned

A test on MIPS64 revealed that the following reg tests would all
fail at the same place in htx_replace_stline() when updating
parts of the request line:
  reg-tests/cache/if-modified-since.vtc
  reg-tests/http-rules/h1or2_to_h1c.vtc
  reg-tests/http-rules/http_after_response.vtc
  reg-tests/http-rules/normalize_uri.vtc
  reg-tests/http-rules/path_and_pathq.vtc

While the status line is normally aligned since it's the first block
of the HTX, it may become unaligned once replaced. The problem is, it
is a structure which contains some u16 and u32, and dereferencing them
on machines not natively supporting unaligned accesses makes them crash
or handle crap. Typically, MIPS/MIPS64/SPARC will crash, ARMv5 will
either crash or (more likely) return swapped values and do crap, and
RISCV will trap and turn to slow emulation.

We can assign the htx_sl struct the packed attribute, but then this
also causes the ints to fill the 2-bytes gap before them, always causing
unaligned accesses for this part on such machines. The patch does a bit
better, by explicitly filling this two-bytes hole, and packing the
struct.

This should be backported to all versions.

(cherry picked from commit 276cdc11e8d9509c0373a0acb9f580097c27d51a)
Signed-off-by: Amaury Denoyelle <adenoyelle@haproxy.com>
(cherry picked from commit efe13040d16d27407de92d1f0c9d0bbc80d608b3)
Signed-off-by: Amaury Denoyelle <adenoyelle@haproxy.com>
(cherry picked from commit 7e1e152429aed65e22f02209d5db8ce741355f41)
Signed-off-by: Amaury Denoyelle <adenoyelle@haproxy.com>
(cherry picked from commit 8f463916c07918c0acb193592982d0634fd0427b)
Signed-off-by: Amaury Denoyelle <adenoyelle@haproxy.com>