From: Kelly Kane <kelly@hawknetworks.com>
Date: Sun, 25 Oct 2026 01:03:03 +0000 (+0000)
Subject: BUG/MINOR: hlua: unlock Patref before add_bulk type error
X-Git-Tag: v3.5-dev10~41
X-Git-Url: https://git.kaiwu.me/$%7BISSUES%7D/static/gitweb.js?a=commitdiff_plain;h=dbcc5a4a490802bc1585292d4ac75c136f61d522;p=haproxy.git

BUG/MINOR: hlua: unlock Patref before add_bulk type error

Patref:add_bulk checks table entries while holding the pattern reference
write lock. luaL_checktype() raises on a non-string entry and bypasses
the unlock, blocking later updates. Check types without raising while
locked, then unlock before reporting the original Lua error.

Signed-off-by: Kelly Kane <kelly@hawknetworks.com>

It should be backported to 3.2.
---

diff --git a/src/hlua_fcn.c b/src/hlua_fcn.c
index 5a53e5212..15e96346b 100644
--- a/src/hlua_fcn.c
+++ b/src/hlua_fcn.c
@@ -2928,14 +2928,26 @@ static int _hlua_patref_add_bulk(lua_State *L, int status, lua_KContext ctx)
 
 		if (ref->ptr->flags & PAT_REF_SMP) {
 			/* key:val table */
-			luaL_checktype(L, -2, LUA_TSTRING);
+			if (lua_type(L, -2) != LUA_TSTRING) {
+				HA_RWLOCK_WRUNLOCK(PATREF_LOCK, &ref->ptr->lock);
+				luaL_checktype(L, -2, LUA_TSTRING);
+				return 0; // not reached
+			}
 			key = lua_tostring(L, -2);
-			luaL_checktype(L, -1, LUA_TSTRING);
+			if (lua_type(L, -1) != LUA_TSTRING) {
+				HA_RWLOCK_WRUNLOCK(PATREF_LOCK, &ref->ptr->lock);
+				luaL_checktype(L, -1, LUA_TSTRING);
+				return 0; // not reached
+			}
 			value = lua_tostring(L, -1);
 		}
 		else {
 			/* key-only table, use value as key */
-			luaL_checktype(L, -1, LUA_TSTRING);
+			if (lua_type(L, -1) != LUA_TSTRING) {
+				HA_RWLOCK_WRUNLOCK(PATREF_LOCK, &ref->ptr->lock);
+				luaL_checktype(L, -1, LUA_TSTRING);
+				return 0; // not reached
+			}
 			key = lua_tostring(L, -1);
 		}