tree 681281c071e20b514c34cb57fb425cd84a787fcd
parent 4bdd0696373b5a683cfab905c65c5af103855bd3
author Christopher Faulet <cfaulet@haproxy.com> 1677595178 +0100
committer Christopher Faulet <cfaulet@haproxy.com> 1677605789 +0100

BUG/MEDIUM: connection: Clear flags when a conn is removed from an idle list

When a connection is removed from the safe list or the idle list,
CO_FL_SAFE_LIST and CO_FL_IDLE_LIST flags must be cleared. It is performed
when the connection is reused. But not when it is moved into the
toremove_conns list. It may be an issue because the multiplexer owning the
connection may be woken up before the connection is really removed. If the
connection flags are not sanitized, it may think the connection is idle and
reinsert it in the corresponding list. From this point, we can imagine
several bugs. An UAF or a connection reused with an invalid state for
instance.

To avoid any issue, the connection flags are sanitized when an idle
connection is moved into the toremove_conns list. The same is performed at
right places in the multiplexers. Especially because the connection release
may be delayed (for h2 and fcgi connections).

This patch shoudld fix the issue #2057. It must carefully be backported as
far as 2.2. Especially on the 2.2 where the code is really different. But
some conflicts should be expected on the 2.4 too.