From: Frédéric Lécaille <flecaille@haproxy.com>
Date: Wed, 21 Jul 2021 07:34:27 +0000 (+0200)
Subject: MINOR: quic: Unitialized mux context upon Client Hello message receipt.
X-Git-Tag: v2.5-dev8~100
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=01abc4612b1b59f83718d929b60d2e6f0d2554c9;p=thirdparty%2Fhaproxy.git

MINOR: quic: Unitialized mux context upon Client Hello message receipt.

If we let the connection packet handler task (quic_conn_io_cb) process the first
client Initial packet which contain the TLS Client Hello message before the mux
context is initialized, quic_mux_transport_params_update() makes haproxy crash.
->start xprt callback already wakes up this task and is called after all the
connection contexts are initialized. So, this patch do not wakes up quic_conn_io_cb()
if the mux context is not initialized (this was already the case for the connection
context (conn_ctx)).
---

diff --git a/src/mux_quic.c b/src/mux_quic.c
index fc51f0f7dc..a7e3838205 100644
--- a/src/mux_quic.c
+++ b/src/mux_quic.c
@@ -741,7 +741,7 @@ static int qc_init(struct connection *conn, struct proxy *prx,
 	LIST_INIT(&qcc->buf_wait.list);
 	MT_LIST_INIT(&qcc->qcs_rxbuf_wlist);
 
-	conn->ctx = qcc;
+	HA_ATOMIC_STORE(&conn->ctx, qcc);
 
 	if (t)
 		task_queue(t);
diff --git a/src/xprt_quic.c b/src/xprt_quic.c
index 5bc3495d57..eec3b5cd00 100644
--- a/src/xprt_quic.c
+++ b/src/xprt_quic.c
@@ -3441,8 +3441,13 @@ static ssize_t qc_lstnr_pkt_rcv(unsigned char **buf, const unsigned char *end,
 
 
 	TRACE_PROTO("New packet", QUIC_EV_CONN_LPKT, qc->conn, pkt);
-	if (conn_ctx)
-		/* Wake the tasklet of the QUIC connection packet handler. */
+	/* Wake up the connection packet handler task from here only if all
+	 * the contexts have been initialized, especially the mux context
+	 * conn_ctx->conn->ctx. Note that this is ->start xprt callback which
+	 * will start it if these contexts for the connection are not already
+	 * initialized.
+	 */
+	if (conn_ctx && HA_ATOMIC_LOAD(&conn_ctx->conn->ctx))
 		tasklet_wakeup(conn_ctx->wait_event.tasklet);
 
 	TRACE_LEAVE(QUIC_EV_CONN_LPKT, qc->conn, pkt);