BUG/MEDIUM: h2: Remove the tasklet from the task list if unsubscribing.

In h2_unsubscribe(), if we unsubscribe on SUB_CALL_UNSUBSCRIBE, then remove
ourself from the sending_list, and remove the tasklet from the task list.
We're probably about to destroy the stream anyway, so we don't want the
tasklet to run, or to stay in the sending_list, or it could lead to a crash.

This should be backpored to 1.9.

diff --git a/src/mux_h2.c b/src/mux_h2.c
index f22e0e1c57e0ef46f9198c54302733135d0f9871..959bcfbc032493b2c044db7fc4833bfcf43c7d2c 100644 (file)
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -5182,9 +5182,11 @@ static int h2_unsubscribe(struct conn_stream *cs, int event_type, void *param)
                sw = param;
                if (h2s->send_wait == sw) {
                        sw->events &= ~SUB_CALL_UNSUBSCRIBE;
+                       task_remove_from_task_list((struct task *)h2s->send_wait->task);
                        h2s->send_wait = NULL;
                        LIST_DEL(&h2s->list);
                        LIST_INIT(&h2s->list);
+                       LIST_DEL_INIT(&h2s->sending_list);
                }
        }
        return 0;