]> git.ipfire.org Git - thirdparty/haproxy.git/commitdiff
BUG/MINOR: quix: Memleak for non in flight TX packets
authorFrédéric Lécaille <flecaille@haproxy.com>
Mon, 22 Aug 2022 16:47:51 +0000 (18:47 +0200)
committerFrédéric Lécaille <flecaille@haproxy.com>
Mon, 22 Aug 2022 17:06:08 +0000 (19:06 +0200)
First, these packets must not be inserted in the tree of TX packets.
They are never explicitely acknowledged (for instance an ACK only
packet will never be acknowledged). Furthermore, if taken into an account
these packets may uselessly disturb the congestion control. We do not care
if they are lost or not. Furthermore as the ->in_fligh_len member value is null
they were not released by qc_release_lost_pkts() which rely on these values
to decide to release the allocated memory for such packets.

Must be backported to 2.6.

src/xprt_quic.c

index f6497f102a5e3e1754e7988ae3e56da861dae8ae..0a0ab358cbfe82e2188d5eda77f11aaf30ac358f 100644 (file)
@@ -3253,12 +3253,21 @@ int qc_send_ppkts(struct buffer *buf, struct ssl_sock_ctx *ctx)
                        }
                        qc->path->in_flight += pkt->in_flight_len;
                        pkt->pktns->tx.in_flight += pkt->in_flight_len;
-                       if (pkt->in_flight_len)
-                               qc_set_timer(qc);
-                       TRACE_DATA("sent pkt", QUIC_EV_CONN_SPPKTS, qc, pkt);
                        next_pkt = pkt->next;
-                       quic_tx_packet_refinc(pkt);
-                       eb64_insert(&pkt->pktns->tx.pkts, &pkt->pn_node);
+                       TRACE_DATA("sent pkt", QUIC_EV_CONN_SPPKTS, qc, pkt);
+                       if (pkt->in_flight_len) {
+                               /* Ack-eliciting packets or packets with a PADDING frame */
+                               quic_tx_packet_refinc(pkt);
+                               eb64_insert(&pkt->pktns->tx.pkts, &pkt->pn_node);
+                               qc_set_timer(qc);
+                       }
+                       else {
+                               /* Note that we can safely free this packet: There is no
+                                * ack-eliciting frame attached to it. This may be an ACK
+                                * or CONNECTION_CLOSE only packet for instance.
+                                */
+                               pool_free(pool_head_quic_tx_packet, pkt);
+                       }
                }
        }