BUG/MINOR: hlua_fcn: fix potential UAF with Queue:pop_wait()
authorAurelien DARRAGON <adarragon@haproxy.com>
Tue, 1 Apr 2025 09:01:45 +0000 (11:01 +0200)
committerAurelien DARRAGON <adarragon@haproxy.com>
Tue, 15 Apr 2025 20:27:00 +0000 (22:27 +0200)
commit12d3fc470d9b3593d5b5b31f230111341602eeb1
tree1228a116b292cf5b380da7d82c046ed72144ec97
parentf2eec2789d30fd96d0b86d89dbb24c5bf2ea48ff
BUG/MINOR: hlua_fcn: fix potential UAF with Queue:pop_wait()

If Queue:pop_wait() excecuted from a stream context and pop_wait() is
aborted due to a Lua or ressource error, then the waiting object pointing
to the task will still be registered, so if the task eventually dissapears,
Queue:push() may try to wake invalid task pointer..

To prevent this bug from happening, we now rely on notification_* API to
deliver waiting signals. This way signals are properly garbage collected
when a lua context is destroyed.

It should be backported in 2.8 with 86fb22c55 ("MINOR: hlua_fcn: add Queue
class").
This patch depends on ("MINOR: task: add thread safe notification_new and
notification_wake variants")

(cherry picked from commit c6fa061f22e0409a9c1e0dbe9d4bd9a30eff6ba1)
Signed-off-by: Aurelien DARRAGON <adarragon@haproxy.com>
(cherry picked from commit 51de928f9eda86631ef627d2a750a02857ccc38b)
[ada: ctx adjt]
Signed-off-by: Aurelien DARRAGON <adarragon@haproxy.com>
src/hlua_fcn.c