From: Christopher Faulet <cfaulet@haproxy.com>
Date: Wed, 30 Apr 2025 12:32:16 +0000 (+0200)
Subject: BUG/MINOR: mux-h1: Fix trace message in h1_detroy() to not relay on connection
X-Git-Tag: v3.2-dev13~18
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7dc4e94830ef8fe9b0ffc2901d63b9f3183ed12c;p=thirdparty%2Fhaproxy.git

BUG/MINOR: mux-h1: Fix trace message in h1_detroy() to not relay on connection

h1_destroy() may be called to release a H1C after a multiplexer upgrade. In
that case, the connection is no longer attached to the H1C. It must not be
used in the h1 trace message because the connection context is no longer a H1C.

Because of this bug, when a H1>H2 upgrade is performed, a crash may be
experienced if the H1 traces are enabled.

This patch must be backport to all stable versions.
---

diff --git a/src/mux_h1.c b/src/mux_h1.c
index 6fef116bd..d65775509 100644
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -4488,7 +4488,7 @@ static void h1_destroy(void *ctx)
 {
 	struct h1c *h1c = ctx;
 
-	TRACE_POINT(H1_EV_H1C_END, h1c->conn);
+	TRACE_POINT(H1_EV_H1C_END);
 	if (!h1c->h1s || h1c->conn->ctx != h1c)
 		h1_release(h1c);
 }