tree 60044d55927156172a98243cf01568927d9dd9ab
parent bd0174758fed578d685c52271b030b10c475fb2b
author Emeric Brun <ebrun@haproxy.com> 1634650810 +0200
committer Willy Tarreau <w@1wt.eu> 1634747154 +0200
encoding latin1

BUG/MAJOR: dns: tcp session can remain attached to a list after a free

Using tcp, after a session release and free, the session can remain
attached to the list of sessions with a response message waiting for
a commit (ds->waiter). This results to a use after free of this
session.

Also, on some error path and after free, a session could remain attached
to the lists of available idle/free sessions (ds->list).

This patch ensure to remove the session from those external lists
before a free.

This patch should be backported to all version including
the dns over tcp (2.4)

(cherry picked from commit d20dc21eeca1d5e936f7a8bfd3d865a032499c65)
Signed-off-by: Willy Tarreau <w@1wt.eu>