Lua's core.tcp() leading to seg faults about haproxy

[capflam]

It happens because the applet is woken up before the connect. And here it happens because of the GC. Otherwise, we wait for the connect to wake the applet up. I'm on a fix.

[Darlelet]

thanks for the repro, I'm able to reproduce:

Somehow alloc_dst_address() is called with srv being NULL here, so de-referencing it later in the function causes the above segfault

This is probably due to the recent patch serie to fix core.tcp() behavior when yield occurs in between socket creation and connecting: 751b59c (+ commits mentioned in the message)

However, this is strange because from the Lua snippet, connect() is not called, so this is strange that connect_server() is called for the socket. At this stage the stream target was not assigned (it is only assigned upon connect() from lua), so it is expected that:

srv = objt_server(s->target);

resolves to NULL in connect_server() in this case.

We need to find out why connect_server() is called too early while the stream is not yet ready.

[Darlelet]

CCing @capflam since he knows this part best :)

[Darlelet]

Oh nice! Good catch

[capflam]

It should be fixed now. It will be backported as usual, as far as 2.6. @vvucetic, in the mean time, to avoid the crash, you should take care to not create a lua socket without calling Socket.connect(). Out of curiosity, what is your use case to do such thing ? I'm asking because I want to be sure to fully understand the root cause of the issue.

[vvucetic]

It should be fixed now. It will be backported as usual, as far as 2.6. @vvucetic, in the mean time, to avoid the crash, you should take care to not create a lua socket without calling Socket.connect(). Out of curiosity, what is your use case to do such thing ? I'm asking because I want to be sure to fully understand the root cause of the issue.

I already reordered code because it didn’t make sense, indeed. Script initialized tcp then did some other checks and returned (in very special case). That caused crashes. I managed to isolate (reproduce) it so figured I’d report.

Thanks for the quick fix, as always.