tree fe2d0faf02ad78fb29ece69c10091d3761c45c7e
parent 5d2ca06f11bf473837bafbeee39f8bb873133177
author Willy Tarreau <w@1wt.eu> 1581498089 +0100
committer Willy Tarreau <w@1wt.eu> 1581499337 +0100
encoding latin1

BUG/MEDIUM: listener: only consider running threads when resuming listeners

In bug #495 we found that it is possible to resume a listener on an
inexistent thread. This happens when a bind's thread_mask contains bits
out of the active threads mask, such as when using "1/odd" or "1/even".
The thread_mask was used as-is to pick a thread number to re-enable the
listener, and given that the highest number is used, 1/odd or 1/even can
produce quite high thread numbers and crash the process by queuing some
entries into non-existent lists.

This bug is an incomplete fix of commit 413e926ba ("BUG/MAJOR: listener:
fix thread safety in resume_listener()") though it will only trigger if
some bind lines are explicitly bound to thread numbers higher than the
thread count. The fix must be backported to all branches having the fix
above (as far as 1.8, though the code is different there, see the commit
message in 1.8 for changes).

There are a few other places where bind_thread is used without
enforcing all_thread_mask, namely when doing fd_insert() while creating
listeners. It seems harmless but would probably deserve another fix.

(cherry picked from commit 50b659476ceb8e5ee3a060df1da0d32d336a58a8)
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from commit b57aba114b045be6eb3d98f1f61a76ad498e46c4)
Signed-off-by: Willy Tarreau <w@1wt.eu>