Segfault caused by max frame size missmatch

[tsamaras]

I think this segfault appeared because the frame fragmentation capability was removed in haproxy 3.1. We have tune.bufsize set to 65536 and were seeing sporadic segfaults because the default SPOE max frame size is set to tune.bufsize -4. Setting --max-frame-size to 65532 has stopped the segfaults.

If there's any more information you need I'd be happy to help.

OS: Ubuntu 24.04-amd64
version info:

$ haproxy -v
HAProxy version 3.1.6 2025/04/11 - https://haproxy.org/
Status: stable branch - will stop receiving fixes around Q1 2026.
Known bugs: http://www.haproxy.org/bugs/bugs-3.1.6.html
Running on: Linux 6.8.0-1025-gcp #27-Ubuntu SMP Thu Feb 20 21:59:09 UTC 2025 x86_64
$ spoa-mirror -V

spoa-mirror v1.2.19 [build 2523] by Miroslav Zagorac <mzagorac@haproxy.com>, Mar 14 2025

  package version         : 1.2.19
  host operating system   : x86_64-pc-linux-gnu
  source code location    : .
  compiler                : gcc
  preprocessor flags      :  
  compiler flags          : -g -O2 -g -O0  -Wall -Wextra -Waggregate-return -Wbad-function-cast -Wcast-align -Wchar-subscripts -Wcomment -Wfloat-equal -Wimplicit -Winline -Wmain -Wmissing-braces -Wmissing-declarations -Wmissing-noreturn -Wmissing-prototypes -Wnested-externs -Wparentheses -Wpointer-arith -Wreturn-type -Wsequence-point -Wshadow -Wstrict-prototypes -Wswitch -Wtrigraphs -Wundef -Wuninitialized -Wunused -Wwrite-strings -Wformat=2 -fno-strict-aliasing

[tsamaras]

I just double checked the spec and realized that the max frame size negotiation in the hand shake is clearly not happening correctly so it's entirely possible the root cause of the bug is in haproxy. I can open an issue there if that's the case.

[zaga00]

Hello @tsamaras,

thank you for reporting the bug.

There have been numerous changes to the haproxy spoe filter recently, so it's possible that the problems are partly caused by that. However, I just noticed that spoa-mirror crashes even with the older haproxy version (3.0) if the frame buffer is too small (set with the --max-frame-size option).

I have to test it more with various combinations of frame buffer size.

[tsamaras]

yeah it seems like there are 2 distinct issues, handling frames > max-frame-size and figuring out why HaProxy is sending them when it should be using the lower of it's max-frame-size and the one it gets in the AGENT-HELLO frame

[zaga00]

Haproxy does not set max-frame-size to the value sent by the agent, which is a bug. When the commit I sent to the haproxy mailing list is applied, the problem with the spoa-mirror program crash will be solved.

I will also check the setting of that value in the program itself, through the parameter --max-frame-size.

[zaga00]

A commit that resolves this issue (haproxy/haproxy@ce8c2d3) has been added to haproxy, version 3.1 will probably have to wait a few days.