From: Christopher Faulet <cfaulet@haproxy.com>
Date: Thu, 1 Aug 2024 14:22:41 +0000 (+0200)
Subject: BUG/MEDIUM: mux-h2: Propagate term flags to SE on error in h2s_wake_one_stream
X-Git-Tag: v3.1-dev5~50
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=184f16ded7a0274bffe99a4795d0a27f8be7c006;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: mux-h2: Propagate term flags to SE on error in h2s_wake_one_stream

When a stream is explicitly woken up by the H2 conneciton, if an error
condition is detected, the corresponding error flag is set on the SE. So
SE_FL_ERROR or SE_FL_ERR_PENDING, depending if the end of stream was
reported or not.

However, there is no attempt to propagate other termination flags. We must
be sure to properly set SE_FL_EOI and SE_FL_EOS when appropriate to be able
to switch a pending error to a fatal error.

Because of this bug, the SE remains with a pending error and no end of
stream, preventing the applicative stream to trully abort it. It means on
some abort scenario, it is possible to block a stream infinitely.

This patch must be backported at least as far as 2.8. No bug was observed on
older versions while the same code is inuse.
---

diff --git a/src/mux_h2.c b/src/mux_h2.c
index 5d9bb20e92..8b670df64b 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -2274,6 +2274,7 @@ static void h2s_wake_one_stream(struct h2s *h2s)
 	    (h2s->h2c->st0 >= H2_CS_ERROR || (h2s->h2c->flags & H2_CF_ERROR) ||
 	     (h2s->h2c->last_sid > 0 && (!h2s->id || h2s->id > h2s->h2c->last_sid)))) {
 		se_fl_set_error(h2s->sd);
+		h2s_propagate_term_flags(h2c, h2s);
 
 		if (h2s->st < H2_SS_ERROR)
 			h2s->st = H2_SS_ERROR;