From: Christopher Faulet <cfaulet@haproxy.com>
Date: Mon, 14 Dec 2020 09:06:12 +0000 (+0100)
Subject: BUG/MEDIUM: mux-h1: Fix a deadlock when a 408 error is pending for a client
X-Git-Tag: v2.4-dev4~32
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=cc043f66b7d6479866037bae00e27fd34fbee70b;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: mux-h1: Fix a deadlock when a 408 error is pending for a client

When a frontend H1 connection timed out waiting for the next request, a 408
error message is returned to the client. It is performed into the H1C task
process function, h1_timeout_task(), and under the idle connection takeover
lock. If the 408 error message cannot be sent immediately, we wait for a
next retry. In this case, the lock must be released.

This bug was introduced by the commit c4bfa59f1d ("MAJOR: mux-h1: Create the
client stream as later as possible") and is specific to the 2.4-DEV. No
backport needed.
---

diff --git a/src/mux_h1.c b/src/mux_h1.c
index adfe0e51cf..f50b9d8444 100644
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -2589,6 +2589,7 @@ static struct task *h1_timeout_task(struct task *t, void *context, unsigned shor
 				h1_send(h1c);
 			if (b_data(&h1c->obuf) || (h1c->flags & H1C_F_ERR_PENDING)) {
 				h1_refresh_timeout(h1c);
+				HA_SPIN_UNLOCK(OTHER_LOCK, &idle_conns[tid].takeover_lock);
 				return t;
 			}
 		}