BUG/MEDIUM: mux-h1: Don't release H1C on timeout if there is a SC attached

When the H1 task timed out, we must be careful to not release the H1
conneciton if there is still a H1 stream with a stream-connector
attached. In this case, we must wait. There are some tests to prevent it
happens. But the last one only tests the UPGRADING state while there is also
the CLOSING state with a SC attached. But, in the end, it is safer to test
if there is a H1 stream with a SC attached.

This patch should partially fix the issue #1943. However, it only prevent
the segfault. There is another bug under the hood. BTW, this one is
2.7-specific. Not backport is needed.

diff --git a/src/mux_h1.c b/src/mux_h1.c
index 9eca08c33769dc8751a9876164c78ae68b5961e8..2cfe17694efbfed6ee4fb355729395ac2b15364e 100644 (file)
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -3262,7 +3262,7 @@ struct task *h1_timeout_task(struct task *t, void *context, unsigned int state)
                        }
                }
 
-               if (h1c->state == H1_CS_UPGRADING) {
+               if (h1c->h1s && !se_fl_test(h1c->h1s->sd, SE_FL_ORPHAN)) {
                        /* Don't release the H1 connection right now, we must destroy the
                         * attached SC first. */
                        se_fl_set(h1c->h1s->sd, SE_FL_EOS | SE_FL_ERROR);