BUG/MINOR: quic: Possible crash in quic_conn_prx_cntrs_update()

quic_conn_prx_cntrs_update() may be called from quic_conn_release() with
NULL as value for ->prx_counters member. This is the case when qc_new_conn() fails
when allocating <buf_area>. In this case quic_conn_prx_cntrs_update() BUG_ON().

Must be backported as far as 2.7.

diff --git a/src/quic_conn.c b/src/quic_conn.c
index 319a614545907b5a40ba6b35a476493f3b9b6481..e5fd58b0c93fa19cae4b7985da60e1adbc991dba 100644 (file)
--- a/src/quic_conn.c
+++ b/src/quic_conn.c
@@ -5716,7 +5716,9 @@ static struct quic_conn *qc_new_conn(const struct quic_version *qv, int ipv4,
 /* Update the proxy counters of <qc> QUIC connection from its counters */
 static inline void quic_conn_prx_cntrs_update(struct quic_conn *qc)
 {
-       BUG_ON(!qc->prx_counters);
+       if (!qc->prx_counters)
+               return;
+
        HA_ATOMIC_ADD(&qc->prx_counters->dropped_pkt, qc->cntrs.dropped_pkt);
        HA_ATOMIC_ADD(&qc->prx_counters->dropped_pkt_bufoverrun, qc->cntrs.dropped_pkt_bufoverrun);
        HA_ATOMIC_ADD(&qc->prx_counters->dropped_parsing, qc->cntrs.dropped_parsing);