BUG/MEDIUM: muxes: Use the right argument when calling the destroy method.

When calling the mux "destroy" method, the argument should be the mux
context, not the connection. In a few instances in the mux code, the
connection was used (mainly when the session wouldn't handle the idle
connection, and the server pool was fool), and that could lead to random
segfaults.

This should be backported to 2.1, 2.0, and 1.9

diff --git a/src/mux_fcgi.c b/src/mux_fcgi.c
index 3fb85b57122edba8cc35075ed76371764adff846..38c2bfd64d772f3651886642fb858f415fcdeb77 100644 (file)
--- a/src/mux_fcgi.c
+++ b/src/mux_fcgi.c
@@ -3468,7 +3468,7 @@ static void fcgi_detach(struct conn_stream *cs)
                                if (eb_is_empty(&fconn->streams_by_id)) {
                                        if (!srv_add_to_idle_list(objt_server(fconn->conn->target), fconn->conn)) {
                                                /* The server doesn't want it, let's kill the connection right away */
-                                               fconn->conn->mux->destroy(fconn->conn);
+                                               fconn->conn->mux->destroy(fconn);
                                                TRACE_DEVEL("outgoing connection killed", FCGI_EV_STRM_END|FCGI_EV_FCONN_ERR);
                                        }
                                        TRACE_DEVEL("reusable idle connection", FCGI_EV_STRM_END, fconn->conn);

diff --git a/src/mux_h1.c b/src/mux_h1.c
index 212a279c624d213e2c6c368d790e08778ca62578..dcba3dfb8be03e4cde2791133ffd8722e5fc2609 100644 (file)
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -2396,7 +2396,7 @@ static void h1_detach(struct conn_stream *cs)
                                h1c->conn->owner = NULL;
                                if (!srv_add_to_idle_list(objt_server(h1c->conn->target), h1c->conn)) {
                                        /* The server doesn't want it, let's kill the connection right away */
-                                       h1c->conn->mux->destroy(h1c->conn);
+                                       h1c->conn->mux->destroy(h1c);
                                        TRACE_DEVEL("outgoing connection killed", H1_EV_STRM_END|H1_EV_H1C_END);
                                        goto end;
                                }

diff --git a/src/mux_h2.c b/src/mux_h2.c
index 6b6f42ea3ec460d28ead0d50e0ac16eb85a14216..d726944a32cdc1981652efaa007dd3ef50fb53f3 100644 (file)
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -3887,7 +3887,7 @@ static void h2_detach(struct conn_stream *cs)
                                        if (eb_is_empty(&h2c->streams_by_id)) {
                                                if (!srv_add_to_idle_list(objt_server(h2c->conn->target), h2c->conn))
                                                        /* The server doesn't want it, let's kill the connection right away */
-                                                       h2c->conn->mux->destroy(h2c->conn);
+                                                       h2c->conn->mux->destroy(h2c);
                                                TRACE_DEVEL("leaving on error after killing outgoing connection", H2_EV_STRM_END|H2_EV_H2C_ERR);
                                                return;
                                        }