From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Tue, 6 Oct 2026 07:45:37 +0000 (+0200)
Subject: BUG/MINOR: ssl: fix trace crash on BE conn release in io cb
X-Git-Tag: v3.5-dev9~199
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=84381f9010d2b9340487b113b774b77ccaf72649;p=haproxy.git

BUG/MINOR: ssl: fix trace crash on BE conn release in io cb

Since 3.3, handling of idle connections in io handler for muxes/SSL has
been extended. On io completion, connection is not reinserted anymore in
the server list if it is in maintenance mode. Also, private connections
are need race protection as they may be purged : on completion, a
connection is reinserted in its parent session. This operation is
failible as it may require an allocation.

In SSL io tasklet, if a BE connection is not reinserted in its idle pool
for one of the two reasons described above, it is freed instead via MUX
destroy callback. This causes a crash if traces are activated as conn
pointer is not updated.

Fix this by ensuring conn pointer is set to NULL after destroy
invokation.

This must be backported up to 3.3.
---

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index d45547eb4..f34ea6ddb 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -7481,6 +7481,7 @@ leave:
 				if (!session_reinsert_idle_conn(conn->owner, conn)) {
 					/* session add conn failure */
 					CALL_MUX_NO_RET(conn->mux, destroy(conn->ctx));
+					conn = NULL;
 					t = NULL;
 				}
 			}
@@ -7493,6 +7494,7 @@ leave:
 		else {
 			/* Do not store an idle conn if server in maintenance. */
 			CALL_MUX_NO_RET(conn->mux, destroy(conn->ctx));
+			conn = NULL;
 			t = NULL;
 		}
 	}