From: Valentine Krasnobaeva <vkrasnobaeva@haproxy.com>
Date: Tue, 18 Mar 2025 15:33:54 +0000 (+0100)
Subject: BUG/MINOR: limits: compute_ideal_maxconn: don't cap remain if fd_hard_limit=0
X-Git-Tag: v3.0.11~4
X-Git-Url: http://git.haproxy.org/?a=commitdiff_plain;h=c57aab7218dbb0c5e20733562ed921d6eeaf66cd;p=haproxy-3.0.git

BUG/MINOR: limits: compute_ideal_maxconn: don't cap remain if fd_hard_limit=0

'global.fd_hard_limit' stays uninitialized, if haproxy is started with -m
(global.rlimit_memmax). 'remain' is the MAX between soft and hard process fd
limits. It will be always bigger than 'global.fd_hard_limit' (0) in this case.

So, if we reassign 'remain' to the 'global.fd_hard_limit' unconditionally,
calculated then 'maxconn' will be even negative and the DEFAULT_MAXCONN (100)
will be set as the 'ideal_maxconn'.

During the 'global.maxconn' calculations in set_global_maxconn(), if the
provided 'global.rlimit_memmax' is quite big, system will refuse to calculate
based on its 'global.maxconn' and we will do a fallback to the 'ideal_maxconn',
which is 100.

Same problem for the configs with SSL frontends and backends.

This fixes the issue #2899.

This should be backported to v3.1.0.

(cherry picked from commit 060f441199aa97d9735dd553bafd231ca615f723)
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from commit 95197ec04e241f33803909c9c6182e832b6ed16e)
[cf: Applied on src/haproxy.c]
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
---

diff --git a/src/haproxy.c b/src/haproxy.c
index 142a1f8..5b79414 100644
--- a/src/haproxy.c
+++ b/src/haproxy.c
@@ -1463,8 +1463,14 @@ static int compute_ideal_maxconn()
 	    && !global.rlimit_memmax)
 		global.fd_hard_limit = DEFAULT_MAXFD;
 
-	if (remain > global.fd_hard_limit)
+	if (global.fd_hard_limit && (remain > global.fd_hard_limit)) {
+		/* cap remain only when global.fd_hard_limit > 0, i.e.: either
+		 * there were no any other limits set and it's defined by lines
+		 * above as DEFAULT_MAXFD (100), or fd_hard_limit is explicitly
+		 * provided in config.
+		 */
 		remain = global.fd_hard_limit;
+	}
 
 	/* subtract listeners and checks */
 	remain -= global.maxsock;