BUG/MEDIUM: mux-h1: Fix a deadlock when a 408 error is pending for a client

When a frontend H1 connection timed out waiting for the next request, a 408
error message is returned to the client. It is performed into the H1C task
process function, h1_timeout_task(), and under the idle connection takeover
lock. If the 408 error message cannot be sent immediately, we wait for a
next retry. In this case, the lock must be released.

This bug was introduced by the commit c4bfa59f1d ("MAJOR: mux-h1: Create the
client stream as later as possible") and is specific to the 2.4-DEV. No
backport needed.

diff --git a/src/mux_h1.c b/src/mux_h1.c
index adfe0e51cf2107dceb3b3cfff1ad7539852846f2..f50b9d8444047a7bbf19f3b29af2ca3d38b3c569 100644 (file)
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -2589,6 +2589,7 @@ static struct task *h1_timeout_task(struct task *t, void *context, unsigned shor
                                h1_send(h1c);
                        if (b_data(&h1c->obuf) || (h1c->flags & H1C_F_ERR_PENDING)) {
                                h1_refresh_timeout(h1c);
+                               HA_SPIN_UNLOCK(OTHER_LOCK, &idle_conns[tid].takeover_lock);
                                return t;
                        }
                }