From: Frédéric Lécaille <flecaille@haproxy.com>
Date: Wed, 20 Apr 2022 13:59:07 +0000 (+0200)
Subject: BUG/MEDIUM: quic: Possible crash with released mux
X-Git-Tag: v2.6-dev7~25
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=89a2ceb1fba7ea59589cb63df143ac31804a0306;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: quic: Possible crash with released mux

It is possible the xprt layer have to process retransmitted STREAM frames after
the mux was released. In this case, there is no need to try to wake it up.
---

diff --git a/src/xprt_quic.c b/src/xprt_quic.c
index 21abd85579..c1a7be1a9c 100644
--- a/src/xprt_quic.c
+++ b/src/xprt_quic.c
@@ -1544,7 +1544,7 @@ static inline void qc_treat_acked_tx_frm(struct quic_conn *qc,
 		pool_free(pool_head_quic_frame, frm);
 	}
 
-	if (stream_acked) {
+	if (stream_acked && qc->mux_state == QC_MUX_READY) {
 		struct qcc *qcc = qc->qcc;
 
 		if (qcc->subs && qcc->subs->events & SUB_RETRY_SEND) {