MINOR: stick-tables: make stktable_release() do nothing on NULL
stktable_release() has been involved in two recent crashes by being
used without enough care. Just like any free() function this one is
often called on an exit path with a possibly unsafe argument. Given
that there is another case (smp_fetch_sc_trackers()) which theorically
could call it with an unchecked NULL, though it cannot happen since
the function doesn't support being called with src_* hence cannot make
use of tmpstkctr, let's rather move the check into the function itself
to make it safer for the long term.
This patch could be backported to 1.8 as a strengthening measure.
diff --git a/src/stick_table.c b/src/stick_table.c
index 8e16830..3c4e783 100644
--- a/src/stick_table.c
+++ b/src/stick_table.c
@@ -412,9 +412,11 @@
ts->ref_cnt--;
HA_SPIN_UNLOCK(STK_TABLE_LOCK, &t->lock);
}
-/* Just decrease the ref_cnt of the current session */
-void stktable_release(struct stktable *t, struct stksess *ts)
+/* Just decrease the ref_cnt of the current session. Does nothing if <ts> is NULL */
+static void stktable_release(struct stktable *t, struct stksess *ts)
{
+ if (!ts)
+ return;
HA_SPIN_LOCK(STK_TABLE_LOCK, &t->lock);
ts->ref_cnt--;
HA_SPIN_UNLOCK(STK_TABLE_LOCK, &t->lock);
@@ -875,8 +877,7 @@
smp->data.type = SMP_T_BOOL;
smp->data.u.sint = !!ts;
smp->flags = SMP_F_VOL_TEST;
- if (ts)
- stktable_release(t, ts);
+ stktable_release(t, ts);
return 1;
}
@@ -2014,7 +2015,7 @@
smp->data.u.sint = !!stkctr;
/* release the ref count */
- if ((stkctr == &tmpstkctr) && stkctr_entry(stkctr))
+ if ((stkctr == &tmpstkctr))
stktable_release(stkctr->table, stkctr_entry(stkctr));
return 1;