BUG/MEDIUM: backend: always call si_detach_endpoint() on async connection failure

In case an asynchronous connection (ALPN) succeeds but the mux fails to
attach, we must release the stream interface's endpoint, otherwise we
leave the stream interface with an endpoint pointing to a freed connection
with si_ops == si_conn_ops, and sess_update_st_cer() calls si_shutw() on
it, causing it to crash.

This must be backported to 1.9 only.

diff --git a/src/backend.c b/src/backend.c
index 6f9557563d812509e8a859cc98e8835e02ffe49a..e9f3605302518d2225700f566ab4b083dcbdab4c 100644 (file)
--- a/src/backend.c
+++ b/src/backend.c
@@ -1108,6 +1108,8 @@ static int conn_complete_server(struct connection *conn)
        return 0;
 
 fail:
+       si_detach_endpoint(&s->si[1]);
+
        if (cs)
                cs_free(cs);
        /* kill the connection now */