tree 627be92a8adc09175c844d4e12c8c095a1c899cd
parent db2c17da60e80091615ddbe8d97cb964d1f00ac7
author Christopher Faulet <cfaulet@haproxy.com> 1602858437 +0200
committer Willy Tarreau <w@1wt.eu> 1602919783 +0200
encoding latin1

BUG/MEDIUM: lb: Always lock the server when calling server_{take,drop}_conn

The server lock must be held when server_take_conn() and server_drop_conn()
lbprm callback functions are called. It is a documented prerequisite but it is
not always performed. It only affects leastconn and fas lb algorithm. Others
don't use these callback functions.

A race condition on the next pending effecive weight (next_eweight) may be
encountered with the leastconn lb algorithm. An agent check may set it to 0
while fwlc_srv_reposition() is called. The server is locked during the
next_eweight update. But because the server lock is not acquired when
fwlc_srv_reposition() is called, we may use it to recompute the server key,
leading to a division by 0.

This patch must be backported as far as 1.8.