From: Frederic Lecaille <flecaille@haproxy.com>
Date: Fri, 22 Nov 2024 14:40:05 +0000 (+0100)
Subject: BUG/MINOR: quic: Avoid BUG_ON() on ->on_pkt_lost() BBR callback call
X-Git-Tag: v3.1.0~39
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7472990f861fbf930c431d85c12f612f1e190fba;p=thirdparty%2Fhaproxy.git

BUG/MINOR: quic: Avoid BUG_ON() on ->on_pkt_lost() BBR callback call

The per-packet delivery rate sample is applied to ack-eliciting packet only
calling ->drs_on_transmit() BBR callback. So, ->on_pkt_lost() which inspects the
delivery rate sampling information during packet loss detection must not be
called for non ack-eliciting packet. If not, it would be facing with non
initialized variables with big chance to trigger a BUG_ON().

As BBR is implemented in the current developement version, there is
no need to backport this patch.
---

diff --git a/src/quic_loss.c b/src/quic_loss.c
index 6cce844689..592b613c75 100644
--- a/src/quic_loss.c
+++ b/src/quic_loss.c
@@ -216,7 +216,9 @@ void qc_packet_loss_lookup(struct quic_pktns *pktns, struct quic_conn *qc,
 		if (tick_is_le(loss_time_limit, now_ms) || reordered) {
 			struct quic_cc *cc = &qc->path->cc;
 
-			if (cc->algo->on_pkt_lost)
+			/* Delivery rate sampling is applied to ack-eliciting packet only. */
+			if ((pkt->flags & QUIC_FL_TX_PACKET_ACK_ELICITING) &&
+			    cc->algo->on_pkt_lost)
 				cc->algo->on_pkt_lost(cc, pkt, pkt->rs.lost);
 			eb64_delete(&pkt->pn_node);
 			LIST_APPEND(lost_pkts, &pkt->list);