tree e377b5265655e2b37aa9147d15495a328c6564c0
parent b6195ef2a6b0cb3f68bc34735313daa640ab3e92
author Willy Tarreau <w@1wt.eu> 1558937411 +0200
committer Willy Tarreau <w@1wt.eu> 1558945799 +0200
encoding latin1

BUG/MEDIUM: queue: fix the tree walk in pendconn_redistribute.

In pendconn_redistribute() we scan the queue using eb32_next() on the
node we've just deleted, which is wrong since the node is not in the
tree anymore, and it could dereference one node that has already been
released by another thread. Note that we cannot use eb32_first() in the
loop here instead because we need to skip pendconns having SF_FORCE_PRST.
Instead, let's keep a copy of the next node before deleting it.

In addition, the pendconn retrieved there is wrong, it uses &node as
the pointer instead of node, resulting in very quick crashes when the
server list is scanned.

Fortunately this only happens when "option redispatch" is used in
conjunction with "maxconn" on server lines, "cookie" for the stickiness,
and when a server goes down with entries in its queue.

This bug was introduced by commit 0355dabd7 ("MINOR: queue: replace
the linked list with a tree") so the fix must be backported to 1.9.