tree e38b380256deded420ea9d855d28a08fb500d3cf
parent 674843ab2dabda10d8c2e8de0cfdd5685d4d26d3
author Willy Tarreau <w@1wt.eu> 1644421756 +0100
committer Willy Tarreau <w@1wt.eu> 1644908870 +0100
encoding latin1

DEBUG: pools: replace the link pointer with the caller's address on pool_free()

Along recent evolutions of the pools, we've lost the ability to reliably
detect double-frees because while in the past the same pointer was being
used to chain the objects in the cache and to store the pool's address,
since 2.0 they're different so the pool's address is never overwritten on
free() and a double-free will rarely be detected.

This patch sets the caller's return address there. It can never be equal
to a pool's address and will help guess what was the previous call path.
It will not work on exotic architectures nor with very old compilers but
these are not the environments where we're trying to get detailed bug
reports, and this is not done by default anyway so we don't care about
this limitation. Note that depending on the inlining status of the
function, the result may differ but that's no big deal either.

A test by placing a double free of an appctx inside the release handler
itself successfully reported the trouble during appctx_free() and showed
that the return address was in stream_int_shutw_applet() (this one calls
the release handler).

(cherry picked from commit 27c8da1fd5e4f906fd3a9f96a4284c886b559305)
[wt: simplified for 2.5 and older, just use POOL_LINK()]
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from commit 8421b0c59f87f6b66683991896aae1be776f992b)
Signed-off-by: Willy Tarreau <w@1wt.eu>