OK I found it, you were indeed right, it's just that I did not
correctly understand the circumstances needed to reproduce it.

It happens if you wait long enough for the servers to be reported
down, then make a first request. The issue is that when exactly
one server is present, only the first place in the hash map is
filled (this was done thinking it meant there was only one server),
but all the entries up to the total farm's weight may be used as
the result of a hash. So we can reach an old entry within the size
of the map, but beyond the place which is initialized, holding an
old server.

Please use this patch, it's obvious and fixes the issue for me here.
I will now check what versions are affected.

Thanks for reporting this,
Willy

diff --git a/src/backend.c b/src/backend.c
index 9ad58fd..8c850d9 100644
--- a/src/backend.c
+++ b/src/backend.c
@@ -174,9 +174,6 @@ void recalc_server_map(struct proxy *px)
        case 0: /* no server */
                px->lbprm.map.state &= ~PR_MAP_RECALC;
                return;
-       case 1: /* only one server, just fill first entry */
-               tot = 1;
-               break;
        default:
                tot = px->lbprm.tot_weight;
                break;


Reply via email to