From: Olivier Houchard <ohouchard@haproxy.com>
Date: Fri, 4 Jan 2019 15:51:40 +0000 (+0100)
Subject: BUG/MEDIUM: h1: In h1_init(), wake the tasklet instead of calling h1_recv().
X-Git-Tag: v2.0-dev1~265
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9b960a860c402ee234af8928867c71105aa25651;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: h1: In h1_init(), wake the tasklet instead of calling h1_recv().

In h1_init(), instead of calling h1_recv() directly, just wake the tasklet,
so that the receive will be done later.
h1_init() might be called from connect_server(), which is itself called
indirectly from process_stream(), and if the receive fails, we may call
si_cs_process(), which may destroy the channel buffers while process_stream()
still expects them to exist.

This should be backported to 1.9.
---

diff --git a/src/mux_h1.c b/src/mux_h1.c
index 4658e48a8b..742572abe5 100644
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -414,8 +414,7 @@ static int h1_init(struct connection *conn, struct proxy *proxy, struct session
 		task_queue(t);
 
 	/* Try to read, if nothing is available yet we'll just subscribe */
-	if (h1_recv(h1c))
-		h1_process(h1c);
+	tasklet_wakeup(h1c->wait_event.task);
 
 	/* mux->wake will be called soon to complete the operation */
 	return 0;