BUG/MEDIUM: task: Do not destroy a task that is not ours in task_destroy

In task_destroy(), if the task is not exclusively ours, then just use
task_kill(). If it is a shared task, then there is a race condition if
another thread tries to schedule it at the same time, which could result
in the task being scheduled after been freed.

This should be backported up to 2.8.

diff --git a/include/haproxy/task.h b/include/haproxy/task.h
index 2a70cdcfd36f12fe4af3ff0c099b8deb9c644035..403c36d2c2b87b0343804727e52afbac0333d9e8 100644 (file)
--- a/include/haproxy/task.h
+++ b/include/haproxy/task.h
@@ -775,6 +775,11 @@ static inline void task_destroy(struct task *t)
        if (!t)
                return;
 
+       if (t->tid != tid) {
+               task_kill(t);
+               return;
+       }
+
        task_unlink_wq(t);
        /* We don't have to explicitly remove from the run queue.
         * If we are in the runqueue, the test below will set t->process