From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Fri, 10 Jun 2022 13:16:40 +0000 (+0200)
Subject: BUG/MINOR: mux-quic: fix memleak on frames rejected by transport
X-Git-Tag: v2.7-dev1~66
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=43c090c1ed9d06100be1e75a87d4e372ba7fee94;p=thirdparty%2Fhaproxy.git

BUG/MINOR: mux-quic: fix memleak on frames rejected by transport

When the MUX transfers a big amount of data to the client, the transport
layer may reject some of them because of the congestion controller
limit. Frames built by the MUX are thus dropped, even if streams transferred
data are kept in buffers for future new frames.

Thus, the MUX is required to free rejected frames. This fixes a memory
leak which may grow with important data transfers.

It should be backported to 2.6 after it has been tested and validated.
---

diff --git a/src/mux_quic.c b/src/mux_quic.c
index c5e2c9e926..0b65b8f2c8 100644
--- a/src/mux_quic.c
+++ b/src/mux_quic.c
@@ -1173,6 +1173,15 @@ static int qc_send(struct qcc *qcc)
 		goto retry;
 
  out:
+	/* Deallocate frames that the transport layer has rejected. */
+	if (!LIST_ISEMPTY(&frms)) {
+		struct quic_frame *frm, *frm2;
+		list_for_each_entry_safe(frm, frm2, &frms, list) {
+			LIST_DELETE(&frm->list);
+			pool_free(pool_head_quic_frame, frm);
+		}
+	}
+
 	TRACE_LEAVE(QMUX_EV_QCC_SEND);
 
 	return total;