From: Olivier Houchard <ohouchard@haproxy.com>
Date: Thu, 9 Apr 2026 13:37:14 +0000 (+0200)
Subject: BUG/MEDIUM: task: Do not destroy a task that is not ours in task_destroy
X-Git-Tag: v3.5-dev8~188
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=42a586e52a60deb4e93c76fafd19349d605a3f7a;p=haproxy.git

BUG/MEDIUM: task: Do not destroy a task that is not ours in task_destroy

In task_destroy(), if the task is not exclusively ours, then just use
task_kill(). If it is a shared task, then there is a race condition if
another thread tries to schedule it at the same time, which could result
in the task being scheduled after been freed.

This should be backported up to 2.8.
---

diff --git a/include/haproxy/task.h b/include/haproxy/task.h
index 2a70cdcfd..403c36d2c 100644
--- a/include/haproxy/task.h
+++ b/include/haproxy/task.h
@@ -775,6 +775,11 @@ static inline void task_destroy(struct task *t)
 	if (!t)
 		return;
 
+	if (t->tid != tid) {
+		task_kill(t);
+		return;
+	}
+
 	task_unlink_wq(t);
 	/* We don't have to explicitly remove from the run queue.
 	 * If we are in the runqueue, the test below will set t->process