BUG/MINOR: hlua_fcn: fix potential UAF with Queue:pop_wait()
authorAurelien DARRAGON <adarragon@haproxy.com>
Tue, 1 Apr 2025 09:01:45 +0000 (11:01 +0200)
committerAurelien DARRAGON <adarragon@haproxy.com>
Tue, 15 Apr 2025 16:37:48 +0000 (18:37 +0200)
commit51de928f9eda86631ef627d2a750a02857ccc38b
tree54ebe4e052a6de7ac8b26e03fd7ac66bc8f3aedd
parentad6e04a1b575a731b01913ff092352d958481775
BUG/MINOR: hlua_fcn: fix potential UAF with Queue:pop_wait()

If Queue:pop_wait() excecuted from a stream context and pop_wait() is
aborted due to a Lua or ressource error, then the waiting object pointing
to the task will still be registered, so if the task eventually dissapears,
Queue:push() may try to wake invalid task pointer..

To prevent this bug from happening, we now rely on notification_* API to
deliver waiting signals. This way signals are properly garbage collected
when a lua context is destroyed.

It should be backported in 2.8 with 86fb22c55 ("MINOR: hlua_fcn: add Queue
class").
This patch depends on ("MINOR: task: add thread safe notification_new and
notification_wake variants")

(cherry picked from commit c6fa061f22e0409a9c1e0dbe9d4bd9a30eff6ba1)
Signed-off-by: Aurelien DARRAGON <adarragon@haproxy.com>
src/hlua_fcn.c