From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Wed, 23 Apr 2025 15:06:22 +0000 (+0200)
Subject: BUG/MINOR: mux-quic: do not decode if conn in error
X-Git-Tag: v3.2-dev12~25
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6c5030f703e29bfd8deeace111bcedc6835c7065;p=thirdparty%2Fhaproxy.git

BUG/MINOR: mux-quic: do not decode if conn in error

Add an early return to qcc_decode_qcs() if QCC instance is flagged on
error and connection is scheduled for immediate closure.

The main objective is to ensure to not trigger BUG_ON() from
qcc_set_error() : if a stream decoding has set the connection error, do
not try to process decoding on other streams as they may also encounter
an error. Thus, the connection is closed asap with the first encountered
error case.

This should be backported up to 2.6, after a period of observation.
---

diff --git a/src/mux_quic.c b/src/mux_quic.c
index 000113645..a366d7b3e 100644
--- a/src/mux_quic.c
+++ b/src/mux_quic.c
@@ -1259,6 +1259,10 @@ static void qcs_consume(struct qcs *qcs, uint64_t bytes, struct qc_stream_rxbuf
 /* Decode the content of STREAM frames already received on the stream instance
  * <qcs> from the <qcc> connection.
  *
+ * It is safe to remove <qcs> from <qcc> recv_list after decoding is done. Even
+ * if an error is returned, caller should consider that no further Rx
+ * processing can be performed for the stream, until new bytes are available.
+ *
  * Returns the result of app_ops rcv_buf callback, which is the number of bytes
  * successfully transcoded, or a negative error code. If no error occurred but
  * decoding cannot proceed due to missing data, the return value is 0. The
@@ -1274,6 +1278,12 @@ static int qcc_decode_qcs(struct qcc *qcc, struct qcs *qcs)
 
 	TRACE_ENTER(QMUX_EV_QCS_RECV, qcc->conn, qcs);
 
+	if (qcc->flags & QC_CF_ERRL) {
+		TRACE_DATA("connection on error", QMUX_EV_QCC_RECV, qcc->conn);
+		ret = -1;
+		goto err;
+	}
+
  restart:
 	rxbuf = qcs_get_curr_rxbuf(qcs);
 	b = qcs_b_dup(rxbuf);