Merge ~paelzer/ubuntu/+source/haproxy:lp-1884149-avoid-crashes-BIONIC into ubuntu/+source/haproxy:ubuntu/bionic-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4108/+packages

[Rafael David Tinoco (rafaeldtinoco)]

# CHECKLIST
----------------------------
 [.] changelog entry correct:
 [.] targeted to correct codename
 [.] version number is correct
 [.] update-maintainer has been run before
 ----
 [-] changes forwarded upstream/debian (if appropriate)
 [.] patches match what was proposed upstream
 ----
 [.] patches correctly included in debian/patches/series?
 [.] patches have correct DEP3 metadata
 ----
 [.] relying on PPA only for build check ?
 [.] if relying on PPA, did it install correctly ?
 ----
 [-] building it locally ?
 [-] if building locally, was source build good ?
 [-] if building locally, was binary build good ?
 ----
 [.] was autopkgtest tested ?
 ----
 [.] is this a SRU ?
 [.] if a SRU, does the public bug have a template ?
 [-] is this a bundle of fixes ?
 [.] is this a single fix ?
 ----
 [.] if single fix, was testcase provided ?
 [-] if single fix, and testcase provided, could I reproduce it ?
 [-] if single fix, and testcase provided, did it work ?
 ----
 [-] is this a MERGE ?
 [-] if MERGE, is there a public bug referred ?
 [-] if MERGE, does it add/remove existing packages ?
 [-] if MERGE, does it bump library SONAME ?
----------------------------
 [.] = ok | [x] = not ok | [?] = question | [!] = note | [-] = n/a
----------------------------

# comments:

Did not try to reproduce as it is an intermittent issue and it has been
bisected in the public bug with the help of affected users.

# changelog:

haproxy (1.8.8-1ubuntu0.11) bionic; urgency=medium

  * Avoid crashes on idle connections between http requests (LP: #1884149)

 -- Christian Ehrhardt <email address hidden> Mon, 22 Jun 2020 10:41:43 +0200

# files touched:

 changelog
 patches/lp-1884149-BUG-MEDIUM-mux_pt-dereference-the-connection-with-ca.patch
 patches/series

# installation:

haproxy 1.8.8-1ubuntu0.11~ppa1 amd64

review: Approve

[Christian Ehrhardt  (paelzer)]

To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/haproxy
 * [new tag] upload/1.8.8-1ubuntu0.11 -> upload/1.8.8-1ubuntu0.11

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading haproxy_1.8.8-1ubuntu0.11.dsc: done.
  Uploading haproxy_1.8.8-1ubuntu0.11.debian.tar.xz: done.
  Uploading haproxy_1.8.8-1ubuntu0.11_source.buildinfo: done.
  Uploading haproxy_1.8.8-1ubuntu0.11_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index 53a249c..fb576a7 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+haproxy (1.8.8-1ubuntu0.11) bionic; urgency=medium
+
+  * Avoid crashes on idle connections between http requests (LP: #1884149)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 22 Jun 2020 10:41:43 +0200
+
 haproxy (1.8.8-1ubuntu0.10) bionic-security; urgency=medium
 
   * SECURITY UPDATE: Arbitrary memory write
diff --git a/debian/patches/lp-1884149-BUG-MEDIUM-mux_pt-dereference-the-connection-with-ca.patch b/debian/patches/lp-1884149-BUG-MEDIUM-mux_pt-dereference-the-connection-with-ca.patch
new file mode 100644
index 0000000..ed7d545
--- /dev/null
+++ b/debian/patches/lp-1884149-BUG-MEDIUM-mux_pt-dereference-the-connection-with-ca.patch
@@ -0,0 +1,44 @@
+From d9a130e1962c2a5352f33088c563f4248a102c48 Mon Sep 17 00:00:00 2001
+From: Willy Tarreau <[e-mail]>
+Date: Fri, 24 Aug 2018 15:48:59 +0200
+Subject: [PATCH] BUG/MEDIUM: mux_pt: dereference the connection with care in
+ mux_pt_wake()
+
+mux_pt_wake() calls data->wake() which can return -1 indicating that the
+connection was just destroyed. We need to check for this condition and
+immediately exit in this case otherwise we dereference a just freed
+connection. Note that this mainly happens on idle connections between
+two HTTP requests. It can have random implications between requests as
+it may lead a wrong connection's polling to be re-enabled or disabled
+for example, especially with threads.
+
+This patch must be backported to 1.8.
+
+(cherry picked from commit ad7f0ad1c3c9c541a4c315b24d4500405d1383ee)
+Signed-off-by: Willy Tarreau <[e-mail]>
+
+Origin: upstream, https://github.com/haproxy/haproxy/commit/d9a130e1962c2a5352f33088c563f4248a102c48
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1884149
+Last-Update: 2020-06-22
+
+---
+ src/mux_pt.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/mux_pt.c b/src/mux_pt.c
+index a68b96215..c43e30f23 100644
+--- a/src/mux_pt.c
++++ b/src/mux_pt.c
+@@ -51,6 +51,9 @@ static int mux_pt_wake(struct connection *conn)
+ 
+ 	ret = cs->data_cb->wake ? cs->data_cb->wake(cs) : 0;
+ 
++	if (ret < 0)
++		return ret;
++
+ 	/* If we had early data, and we're done with the handshake
+ 	 * then whe know the data are safe, and we can remove the flag.
+ 	 */
+-- 
+2.27.0
+
diff --git a/debian/patches/series b/debian/patches/series
index 09bc219..79ffd59 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -18,3 +18,4 @@ lp-1848902-MINOR-systemd-consider-exit-status-143-as-successful.patch
 CVE-2019-19330-1.patch
 CVE-2019-19330-2.patch
 CVE-2020-11100.patch
+lp-1884149-BUG-MEDIUM-mux_pt-dereference-the-connection-with-ca.patch