From: Willy Tarreau <w@1wt.eu>
Date: Tue, 21 Aug 2018 16:33:20 +0000 (+0200)
Subject: BUG/MEDIUM: connection: don't forget to always delete the list's head
X-Git-Tag: v1.9-dev2~133
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1b13bfd646e00ccfafd4727febb2589366733064;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: connection: don't forget to always delete the list's head

During a test it happened that a connection was deleted before the
stream it's attached to, resulting in a crash related to the fix
18a85fe ("BUG/MEDIUM: streams: Don't forget to remove the si from
the wait list.") during the LIST_DEL(). Make sure to always delete
the list's head in this case so that other elements can safely
detach later.

This is purely 1.9, no backport is needed.
---

diff --git a/include/proto/connection.h b/include/proto/connection.h
index 35b9dfe49d..dfaaad78d2 100644
--- a/include/proto/connection.h
+++ b/include/proto/connection.h
@@ -709,6 +709,8 @@ static inline struct conn_stream *cs_new(struct connection *conn)
 /* Releases a connection previously allocated by conn_new() */
 static inline void conn_free(struct connection *conn)
 {
+	LIST_DEL(&conn->send_wait_list);
+	LIST_INIT(&conn->send_wait_list);
 	pool_free(pool_head_connection, conn);
 }