From 3ea351368959da77aa873439d928704a07e0fe4e Mon Sep 17 00:00:00 2001 From: Olivier Houchard Date: Mon, 25 Mar 2019 14:10:42 +0100 Subject: [PATCH] BUG/MEDIUM: h2: Remove the tasklet from the task list if unsubscribing. In h2_unsubscribe(), if we unsubscribe on SUB_CALL_UNSUBSCRIBE, then remove ourself from the sending_list, and remove the tasklet from the task list. We're probably about to destroy the stream anyway, so we don't want the tasklet to run, or to stay in the sending_list, or it could lead to a crash. This should be backpored to 1.9. --- src/mux_h2.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/mux_h2.c b/src/mux_h2.c index f22e0e1c57..959bcfbc03 100644 --- a/src/mux_h2.c +++ b/src/mux_h2.c @@ -5182,9 +5182,11 @@ static int h2_unsubscribe(struct conn_stream *cs, int event_type, void *param) sw = param; if (h2s->send_wait == sw) { sw->events &= ~SUB_CALL_UNSUBSCRIBE; + task_remove_from_task_list((struct task *)h2s->send_wait->task); h2s->send_wait = NULL; LIST_DEL(&h2s->list); LIST_INIT(&h2s->list); + LIST_DEL_INIT(&h2s->sending_list); } } return 0; -- 2.39.5