tree bf96a0a6a8c7d9fdc9061630e6c7ce8c138d3cb8
parent 56ab17d34a32d9c15558c2c2d17b743e6d679cbd
author Amaury Denoyelle <adenoyelle@haproxy.com> 1719501355 +0200
committer Christopher Faulet <cfaulet@haproxy.com> 1719995577 +0200

BUG/MEDIUM: quic: fix race-condition in quic_get_cid_tid()

haproxy generates CID for clients which reuse them as DCID on their
packets. These CID are stored in a global tree quic_cid_trees. Each
operation on this tree must be done under lock protection.

quic_get_cid_tid() is a function which lookups a CID in global tree and
return the associated thread ID. This is used on datagram reception on
listener socket before redispatching the datagram to the correct thread.
This function uses a lock to protect quic_cid_trees access. However,
lock region is too small as CID tree node is accessed outside of it. Fix
this by extending lock protection for CID dereferencement until thread
ID is retrieved.

The impact of this bug is unknown, but it may possible cause crashes.
However, it is probably rare as most of datagram reception is done on
quic_conn socket which does not uses quic_get_cid_tid().

This may fix first crash of github issue #2607.

This must be backported up to 2.8.

(cherry picked from commit 72267ff35f7c82f5a32d99a03124b73d95b00a01)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit ab76fa58e85e069d27a1699f81d60e32133a9fe4)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 01cfd4cb396ea6deb95b734075625b2e9904f8d0)
[cf: applied in quic_conn.c]
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>