]> git.ipfire.org Git - thirdparty/haproxy.git/commitdiff
BUG/MINOR: mux-quic: do not access conn after idle list insert
authorAmaury Denoyelle <adenoyelle@haproxy.com>
Wed, 20 Aug 2025 15:16:28 +0000 (17:16 +0200)
committerAmaury Denoyelle <adenoyelle@haproxy.com>
Thu, 28 Aug 2025 12:52:29 +0000 (14:52 +0200)
Once a connection is inserted into the server idle/safe tree during
stream detach, it is not accessed anymore by the muxes without
idle_conns_lock protection. This is because the connection could have
been already stolen by a takeover operation.

Adjust QUIC MUX detach implementation to follow the same pattern. Note
that, no bug can occur due to takeover as QUIC does not implement it.
However, prior to this patch, there may still exist race-conditions with
idle connection purging.

No backport needed.

src/mux_quic.c

index ad3eaef9c29045b513773f4715b14b66a3e48144..af6e4428e1101cad22cfe2f34c5092edbc306284 100644 (file)
@@ -3822,6 +3822,11 @@ static void qmux_strm_detach(struct sedesc *sd)
                                        goto release;
                                }
 
+                               /* At this point, the connection has been added to the
+                                * server idle list, so another thread may already have
+                                * hijacked it, so we can't do anything with it.
+                                */
+                               conn = NULL;
                                goto end;
                        }
                        else if (!conn->hash_node->node.node.leaf_p &&