From: Christopher Faulet <cfaulet@haproxy.com>
Date: Tue, 22 Nov 2022 16:06:13 +0000 (+0100)
Subject: BUG/MEDIUM: mux-h1: Don't release H1C on timeout if there is a SC attached
X-Git-Tag: v2.7-dev10~25
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f75cc5468a6d4febf2b2263e3e193eeb179a5867;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: mux-h1: Don't release H1C on timeout if there is a SC attached

When the H1 task timed out, we must be careful to not release the H1
conneciton if there is still a H1 stream with a stream-connector
attached. In this case, we must wait. There are some tests to prevent it
happens. But the last one only tests the UPGRADING state while there is also
the CLOSING state with a SC attached. But, in the end, it is safer to test
if there is a H1 stream with a SC attached.

This patch should partially fix the issue #1943. However, it only prevent
the segfault. There is another bug under the hood. BTW, this one is
2.7-specific. Not backport is needed.
---

diff --git a/src/mux_h1.c b/src/mux_h1.c
index 9eca08c337..2cfe17694e 100644
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -3262,7 +3262,7 @@ struct task *h1_timeout_task(struct task *t, void *context, unsigned int state)
 			}
 		}
 
-		if (h1c->state == H1_CS_UPGRADING) {
+		if (h1c->h1s && !se_fl_test(h1c->h1s->sd, SE_FL_ORPHAN)) {
 			/* Don't release the H1 connection right now, we must destroy the
 			 * attached SC first. */
 			se_fl_set(h1c->h1s->sd, SE_FL_EOS | SE_FL_ERROR);