From: Frederic Lecaille Date: Tue, 21 Jan 2025 15:12:05 +0000 (+0100) Subject: MINOR: quic: Add a BUG_ON() on quic_tx_packet refcount X-Git-Tag: v3.2-dev4~15 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4f38c4bfd8c07331258b4b13111a07c7b3013021;p=thirdparty%2Fhaproxy.git MINOR: quic: Add a BUG_ON() on quic_tx_packet refcount This is definitively a bug to call quic_tx_packet_refdec() to decrement the reference counter of a TX packet calling quic_tx_packet_refdec(), and possibly to release its memory when it is negative or null. This counter is incremented when a TX frm is attached to it with some allocated memory and when the packet is inserted into a data structure, if needed (list or tree). Should be easily backported as far as 2.6 to ease any further backport around this code part. --- diff --git a/include/haproxy/quic_tx.h b/include/haproxy/quic_tx.h index 9961a2384..1be932230 100644 --- a/include/haproxy/quic_tx.h +++ b/include/haproxy/quic_tx.h @@ -76,6 +76,7 @@ static inline void quic_tx_packet_refinc(struct quic_tx_packet *pkt) /* Decrement the reference counter of */ static inline void quic_tx_packet_refdec(struct quic_tx_packet *pkt) { + BUG_ON(pkt->refcnt <= 0); if (--pkt->refcnt == 0) { BUG_ON(!LIST_ISEMPTY(&pkt->frms)); /* If there are others packet in the same datagram is attached to,