From: Frederic Lecaille <flecaille@haproxy.com>
Date: Thu, 17 Jul 2025 09:27:59 +0000 (+0200)
Subject: BUG/MEDIUM: quic-be: CC buffer released from wrong pool
X-Git-Tag: v3.3-dev4~69
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4eef300a2c565b2f0dc593e6ec0ad9a336bb611a;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: quic-be: CC buffer released from wrong pool

The "connection close state" TX buffer is used to build the datagram with
basically a CONNECTION_CLOSE frame to notify the peer about the connection
closure. It allows the quic_conn memory release and its replacement by a lighter
quic_cc_conn struct.

For the QUIC backend, there is a dedicated pool to build such datagrams from
bigger TX buffers. But from quic_conn_release(), this is the pool dedicated
to the QUIC frontends which was used to release the QUIC backend TX buffers.

This patch simply adds a test about the target of the connection to release
the "connection close state" TX buffers from the correct pool.

No backport needed.
---

diff --git a/src/quic_conn.c b/src/quic_conn.c
index e8cf8d5f6..cd5f451e7 100644
--- a/src/quic_conn.c
+++ b/src/quic_conn.c
@@ -1519,7 +1519,10 @@ int quic_conn_release(struct quic_conn *qc)
 		free_quic_conn_cids(qc);
 		pool_free(pool_head_quic_cids, qc->cids);
 		qc->cids = NULL;
-		pool_free(pool_head_quic_cc_buf, qc->tx.cc_buf_area);
+		if (objt_listener(qc->target))
+			pool_free(pool_head_quic_cc_buf, qc->tx.cc_buf_area);
+		else
+			pool_free(pool_head_quic_be_cc_buf, qc->tx.cc_buf_area);
 		qc->tx.cc_buf_area = NULL;
 		ret = 1;
 	}