From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Thu, 3 Mar 2022 17:04:24 +0000 (+0100)
Subject: BUG/MINOR: quic: fix segfault on CC if mux uninitialized
X-Git-Tag: v2.6-dev3~70
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2d0f873cd8011edd819d3192c9fc3723f732b85e;p=thirdparty%2Fhaproxy.git

BUG/MINOR: quic: fix segfault on CC if mux uninitialized

A segfault happens when receiving a CONNECTION_CLOSE during handshake.
This is because the mux is not initialized at this stage but the
transport layer dereferences it.

Fix this by ensuring that the MUX is initialized before. Thanks to Willy
for his help on this one. Welcome in the QUIC-men team !
---

diff --git a/src/xprt_quic.c b/src/xprt_quic.c
index 5c260eaab5..34c4811a0b 100644
--- a/src/xprt_quic.c
+++ b/src/xprt_quic.c
@@ -2393,9 +2393,10 @@ static int qc_parse_pkt_frms(struct quic_rx_packet *pkt, struct ssl_sock_ctx *ct
 		case QUIC_FT_CONNECTION_CLOSE:
 		case QUIC_FT_CONNECTION_CLOSE_APP:
 			/* warn the mux to close the connection */
-			if (qc->mux_state == QC_MUX_READY)
+			if (qc->mux_state == QC_MUX_READY) {
 				qc->qcc->flags |= QC_CF_CC_RECV;
-			tasklet_wakeup(qc->qcc->wait_event.tasklet);
+				tasklet_wakeup(qc->qcc->wait_event.tasklet);
+			}
 			break;
 		case QUIC_FT_HANDSHAKE_DONE:
 			if (qc_is_listener(ctx->qc))