MINOR: quic: Add TX packets at the very last time to their tree.

If we add TX packets to their trees before sending them, they may
be detected as lost before being sent. This may make haproxy crash
when it retreives the prepared packets from TX ring buffers, dereferencing
them after they have been freed.

diff --git a/src/xprt_quic.c b/src/xprt_quic.c
index 8340be6afc07226f4cb98d4c2668ce469927d4ee..5bc3495d57c6e05dce3f2e11a5fccb65f02ab81c 100644 (file)
--- a/src/xprt_quic.c
+++ b/src/xprt_quic.c
@@ -2221,6 +2221,7 @@ int qc_send_ppkts(struct qring *qr, struct ssl_sock_ctx *ctx)
                                qc_set_timer(ctx);
                        TRACE_PROTO("sent pkt", QUIC_EV_CONN_SPPKTS, ctx->conn, pkt);
                        next_pkt = pkt->next;
+                       eb64_insert(&pkt->pktns->tx.pkts, &pkt->pn_node);
                        quic_tx_packet_refdec(pkt);
                }
        }
@@ -3931,7 +3932,6 @@ static struct quic_tx_packet *qc_build_hdshk_pkt(unsigned char **pos,
                qc->path->prep_in_flight += pkt->len;
        }
        pkt->pktns = qel->pktns;
-       eb64_insert(&qel->pktns->tx.pkts, &pkt->pn_node);
        TRACE_LEAVE(QUIC_EV_CONN_HPKT, qc->conn, pkt);
 
        return pkt;
@@ -4132,7 +4132,6 @@ static struct quic_tx_packet *qc_build_phdshk_apkt(unsigned char **pos,
                qc->path->prep_in_flight += pkt->len;
        }
        pkt->pktns = qel->pktns;
-       eb64_insert(&qel->pktns->tx.pkts, &pkt->pn_node);
        TRACE_LEAVE(QUIC_EV_CONN_PAPKT, qc->conn, pkt);
 
        return pkt;