{{ message }}
Repository navigation
Segfault shortly after start with a mode log backend server udp@... and check without port; haproxy -c accepts the configuration #3528
Description
Detailed Description of the Problem
A mode log backend whose server is udp@
: with check (and no port on the check) passes haproxy -c, then the process crashes with SIGSEGV about two seconds after start. The timing did not change with inter 60s or with timeout connect 5s.$ haproxy -c -f crash.cfg; echo $?
0
$ haproxy -f crash.cfg -db; echo $?
[NOTICE] (...) : Automatically setting global.maxconn to 262126.
Segmentation fault (core dumped)
139
The same configuration runs normally with check port 18515 instead of check, and without check. HAProxy printed nothing before the crash.
Expected Behavior
Either the check uses the server's port, or the configuration is refused at parse time (and by haproxy -c) with a message saying the check needs a port. A configuration that validates should not crash the process.
Steps to Reproduce the Behavior
-
Save the configuration below as crash.cfg.
-
haproxy -c -f crash.cfg - exits 0.
-
haproxy -f crash.cfg -db - segfaults after about two seconds (exit 139).
-
Change check to check port 18515 - the process runs.
Nothing needs to listen on either port.
Do you have any idea what may have caused this?
No.
Do you have an idea how to solve the issue?
No. We always write port on such checks now.
What is your configuration?
defaults
timeout connect 2s
timeout client 5s
timeout server 5s
log-forward syslog-in
dgram-bind 127.0.0.1:18514
log backend@be-syslog local0
backend be-syslog
mode log
balance roundrobin
server s1 udp@127.0.0.1:18515 checkOutput of haproxy -vv
HAProxy version 3.4.6-1ppa1~resolute 2026/09/30 - https://haproxy.org/
Status: long-term supported branch - will stop receiving fixes around Q2 2031.
Known bugs: http://www.haproxy.org/bugs/bugs-3.4.6.html
Running on: Linux 7.0.0-38-generic #38-Ubuntu SMP PREEMPT_DYNAMIC Fri Sep 4 09:10:14 UTC 2026 x86_64
Build options :
TARGET = linux-glibc
CC = x86_64-linux-gnu-gcc
CFLAGS = -O2 -g -fwrapv -fvect-cost-model=very-cheap -g -O2 -Werror=implicit-function-declaration -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -flto=auto -ffat-lto-objects -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -fdebug-prefix-map=/build/haproxy-fMvzI9/haproxy-3.4.6=/usr/src/haproxy-3.4.6-1ppa1~resolute -Wdate-time -D_FORTIFY_SOURCE=3
OPTIONS = USE_OPENSSL=1 USE_LUA=1 USE_SLZ=1 USE_OT=1 USE_QUIC=1 USE_PROMEX=1 USE_PCRE2=1 USE_PCRE2_JIT=1
DEBUG =
Feature list : -51DEGREES +ACCEPT4 +ACME +BACKTRACE -CLOSEFROM +CPU_AFFINITY +CRYPT_H -DEVICEATLAS +DL -ECH -ENGINE +EPOLL -EVPORTS +GETADDRINFO +HAVE_TCP_MD5SIG -KQUEUE +KTLS -LIBATOMIC +LIBCRYPT +LINUX_CAP +LINUX_SPLICE +LINUX_TPROXY +LUA +MATH -MEMORY_PROFILING +NETFILTER +NS -OBSOLETE_LINKER +OPENSSL -OPENSSL_AWSLC -OPENSSL_WOLFSSL +OT -PCRE +PCRE2 +PCRE2_JIT -PCRE_JIT +POLL +PRCTL -PROCCTL +PROMEX -PTHREAD_EMULATION +QUIC -QUIC_OPENSSL_COMPAT +RT +SHM_OPEN +SLZ +SSL -STATIC_PCRE -STATIC_PCRE2 +TFO +THREAD +THREAD_DUMP +TPROXY +TRACE -WURFL -ZLIB
Detected feature list : +HAVE_WORKING_TCP_MD5SIG
Default settings :
bufsize = 16384, maxrewrite = 1024, maxpollevents = 200
Built with multi-threading support (MAX_TGROUPS=32, MAX_THREADS=1024, default=8).
Built with SSL library version : OpenSSL 3.5.5 27 Jan 2026
Running on SSL library version : OpenSSL 3.5.5 27 Jan 2026
SSL library supports TLS extensions : yes
SSL library supports SNI : yes
SSL library default verify directory : /usr/lib/ssl/certs
SSL library supports : TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3
OpenSSL providers loaded : default
QUIC: connection sock-per-conn mode support : yes
QUIC: GSO emission support : yes
Built with Lua version : Lua 5.4.8
Built with the Prometheus exporter as a service
Built with network namespace support.
Built with OpenTracing support.
Built with libslz for stateless compression.
Compression algorithms supported : identity("identity"), deflate("deflate"), raw-deflate("deflate"), gzip("gzip")
Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT IP_FREEBIND
Built with PCRE2 version : 10.46 2025-08-27
PCRE2 library supports JIT : yes
Encrypted password support via crypt(3): yes
Built with gcc compiler version 15.2.0
Available polling systems :
epoll : pref=300, test result OK
poll : pref=200, test result OK
select : pref=150, test result OK
Total: 3 (3 usable), will use epoll.
Available multiplexer protocols :
(protocols marked as <default> cannot be specified using 'proto' keyword)
quic : mode=HTTP side=FE|BE mux=QUIC flags=HTX|NO_UPG|FRAMED
qmux : mode=HTTP side=FE|BE mux=QMUX flags=HTX|NO_UPG
h2 : mode=HTTP side=FE|BE mux=H2 flags=HTX|HOL_RISK|NO_UPG
h1 : mode=HTTP side=FE|BE mux=H1 flags=HTX|NO_UPG
<default> : mode=HTTP side=FE|BE mux=H1 flags=HTX
fcgi : mode=HTTP side=BE mux=FCGI flags=HTX|HOL_RISK|NO_UPG
spop : mode=SPOP side=BE mux=SPOP flags=HOL_RISK|NO_UPG
<default> : mode=SPOP side=BE mux=SPOP flags=HOL_RISK|NO_UPG
none : mode=TCP side=FE|BE mux=PASS flags=NO_UPG
<default> : mode=TCP side=FE|BE mux=PASS flags=
Available services : prometheus-exporter
Available filters :
[BWLIM] bwlim-in
[BWLIM] bwlim-out
[CACHE] cache
[COMP] comp-req
[COMP] comp-res
[COMP] compression
[FCGI] fcgi-app
[ OT] opentracing
[SPOE] spoe
[TRACE] trace
Last Outputs and Backtraces
No backtrace available: no debugger on the host, and HAProxy printed nothing before the crash.
Additional Information
Ubuntu 26.04, package 3.4.6-1ppa1~resolute from the vbernat PPA, x86_64. Reproduced as an unprivileged user with the configuration above.
Activity
Darlelet commentedon Oct 9, 2026
Hi
many thanks for the report and the reproducer!
Depending on the operating system, it may not crash but report a socket error instead:
It looks like haproxy is trying to perform the check without using the (implicit) port from the server. I'll take a look
Darlelet commentedon Oct 9, 2026
Ok found it. In fact the checks code correctly uses the implicit sv->svc_port from the server. However, we don't support UDP (ICMP) checks, and when
portis mentioned on a server line, it automatically converts the check address into stream family to trigger a TCP check, while whenportis missing, tcp check code uses the raw server address (here it is datagram family) and lower layers either raise a socket error when trying to connect or may segfault as you've seen since it is not expected to use a datagram family socket with TCP oriented API.I don't know how to properly address this. Either we force haproxy checks to always enforce stream mode for log backends, or we warn the user that we don't support UDP checks so the use of
portis mandatory to configure explicit TCP check?