From: Olivier Houchard <ohouchard@haproxy.com>
Date: Thu, 17 Oct 2019 16:02:53 +0000 (+0200)
Subject: BUG/MEDIUM: mux_pt: Make sure we don't have a conn_stream before freeing.
X-Git-Tag: v2.1-dev3~54
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e8826ded5fea3593d89da2be5c2d81c522070995;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: mux_pt: Make sure we don't have a conn_stream before freeing.

On error, make sure we don't have a conn_stream before freeing the connection
and the associated mux context. Otherwise a stream will still reference
the connection, and attempt to use it.
If we still have a conn_stream, it will properly be free'd when the detach
method is called, anyway.

This should be backported to 2.0 and 1.9.
---

diff --git a/src/mux_pt.c b/src/mux_pt.c
index a86cbefd92..b957ed6322 100644
--- a/src/mux_pt.c
+++ b/src/mux_pt.c
@@ -51,9 +51,10 @@ static struct task *mux_pt_io_cb(struct task *t, void *tctx, unsigned short stat
 	struct mux_pt_ctx *ctx = tctx;
 
 	conn_sock_drain(ctx->conn);
-	if (ctx->conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH))
-		mux_pt_destroy(ctx);
-	else
+	if (ctx->conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH)) {
+		if (!ctx->cs)
+			mux_pt_destroy(ctx);
+	} else
 		ctx->conn->xprt->subscribe(ctx->conn, ctx->conn->xprt_ctx, SUB_RETRY_RECV,
 		    &ctx->wait_event);
 
@@ -193,7 +194,7 @@ static void mux_pt_detach(struct conn_stream *cs)
 	    !(conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH))) {
 		ctx->cs = NULL;
 		conn->xprt->subscribe(conn, conn->xprt_ctx, SUB_RETRY_RECV, &ctx->wait_event);
-	} else
+	} else if (!ctx->cs)
 		/* There's no session attached to that connection, destroy it */
 		mux_pt_destroy(ctx);
 }