]> git.kaiwu.me - haproxy.git/commit
BUG/MEDIUM: connection: don't leak the fd of an accepted connection
authorChristopher Faulet <cfaulet@haproxy.com>
Thu, 22 Oct 2026 08:12:11 +0000 (10:12 +0200)
committerChristopher Faulet <cfaulet@haproxy.com>
Fri, 23 Oct 2026 17:36:57 +0000 (19:36 +0200)
commitad082111a04b4387f8aa76e386a2f340f9583bd2
tree167e326bf18b25735aa8dd9f7d41c7d39570128a
parent2a058151a873bcc9554ebc53e9cb44da38d9f8fd
BUG/MEDIUM: connection: don't leak the fd of an accepted connection

When session_accept_fd() fails in conn_prepare(), e.g. because the SSL
connection limit (maxsslconn) is reached, conn_ctrl_init() hasn't run yet
and CO_FL_CTRL_READY isn't set. conn_ctrl_close() then cannot close the fd,
leaving it open. Additional incoming connections on the same listener keep
accumulating leaked fds, even after the SSL connections are released, and
may ultimately exhaust maxsock, also preventing non-SSL frontends from
accepting.

Fix this by closing the fd in conn_ctrl_close() when it hasn't been
registered yet, unless the connection is fdless.

Many thanks to Adam Crawford for the report.

This should be backported to all supported versions.
include/haproxy/connection.h