BUG/MEDIUM: mux-pt: Release the tasklet during an HTTP upgrade

When a TCP connection is upgraded to HTTP, the passthrough multiplexer owning
the client connection is detroyed and replaced by an HTTP multiplexer. When it
happens, the connection context is changed (it is in fact the mux itself). Thus,
when the mux-pt is destroyed, the connection is not released. But, only the
connection must be kept. Everything else concerning the mux must be
released. Especially, the tasklet used for I/O subscriptions. In this part,
there was a bug and the tasklet was never released.

This patch should fix the issue #935. It must be backported as far as 2.0.

diff --git a/src/mux_pt.c b/src/mux_pt.c
index a9fe0091fc80cd0f4f7c69edebf22dc96f2efe61..57c1b9ef4178a712a61d6b0b522c42608a748aaa 100644 (file)
--- a/src/mux_pt.c
+++ b/src/mux_pt.c
@@ -26,23 +26,31 @@ DECLARE_STATIC_POOL(pool_head_pt_ctx, "mux_pt", sizeof(struct mux_pt_ctx));
 
 static void mux_pt_destroy(struct mux_pt_ctx *ctx)
 {
-       /* The connection must be aattached to this mux to be released */
-       if (ctx && ctx->conn && ctx->conn->ctx == ctx) {
-               struct connection *conn = ctx->conn;
+       struct connection *conn = NULL;
+
+       if (ctx) {
+               /* The connection must be attached to this mux to be released */
+               if (ctx->conn && ctx->conn->ctx == ctx)
+                       conn = ctx->conn;
 
-               conn_stop_tracking(conn);
-               conn_full_close(conn);
                tasklet_free(ctx->wait_event.tasklet);
+
+               if (conn && ctx->wait_event.events != 0)
+                       conn->xprt->unsubscribe(conn, conn->xprt_ctx, ctx->wait_event.events,
+                                               &ctx->wait_event);
+               pool_free(pool_head_pt_ctx, ctx);
+       }
+
+       if (conn) {
                conn->mux = NULL;
                conn->ctx = NULL;
+
+               conn_stop_tracking(conn);
+               conn_full_close(conn);
                if (conn->destroy_cb)
                        conn->destroy_cb(conn);
-               /* We don't bother unsubscribing here, as we're about to destroy
-                * both the connection and the mux_pt_ctx
-                */
                conn_free(conn);
        }
-       pool_free(pool_head_pt_ctx, ctx);
 }
 
 /* Callback, used when we get I/Os while in idle mode */