From: Olivier Houchard <ohouchard@haproxy.com>
Date: Mon, 25 Mar 2019 13:10:42 +0000 (+0100)
Subject: BUG/MEDIUM: h2: Remove the tasklet from the task list if unsubscribing.
X-Git-Tag: v2.0-dev2~6
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3ea351368;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: h2: Remove the tasklet from the task list if unsubscribing.

In h2_unsubscribe(), if we unsubscribe on SUB_CALL_UNSUBSCRIBE, then remove
ourself from the sending_list, and remove the tasklet from the task list.
We're probably about to destroy the stream anyway, so we don't want the
tasklet to run, or to stay in the sending_list, or it could lead to a crash.

This should be backpored to 1.9.
---

diff --git a/src/mux_h2.c b/src/mux_h2.c
index f22e0e1c57..959bcfbc03 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -5182,9 +5182,11 @@ static int h2_unsubscribe(struct conn_stream *cs, int event_type, void *param)
 		sw = param;
 		if (h2s->send_wait == sw) {
 			sw->events &= ~SUB_CALL_UNSUBSCRIBE;
+			task_remove_from_task_list((struct task *)h2s->send_wait->task);
 			h2s->send_wait = NULL;
 			LIST_DEL(&h2s->list);
 			LIST_INIT(&h2s->list);
+			LIST_DEL_INIT(&h2s->sending_list);
 		}
 	}
 	return 0;