From: Willy Tarreau <w@1wt.eu>
Date: Wed, 5 Nov 2025 07:46:33 +0000 (+0100)
Subject: BUG/MEDIUM: mux-h2: make sure not to move a dead connection to idle
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=59c599f3f07c549c195f1bd877d2c2a09e6bc61f;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: mux-h2: make sure not to move a dead connection to idle

In h2_detach(), it looks possible to place a dead connection back to
the idle list, and to later call h2_release() on it once detected as
dead. It's not certain that it happens but nothing in the code shows
it is not possible, so better make sure it cannot happen.

This should be preventively backported to all versions.
---

diff --git a/src/mux_h2.c b/src/mux_h2.c
index a5232d0ca..ab2e5bfe9 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -5577,7 +5577,7 @@ static void h2_detach(struct sedesc *sd)
 
 	h2s_destroy(h2s);
 
-	if (h2c->flags & H2_CF_IS_BACK) {
+	if (h2c->flags & H2_CF_IS_BACK && !h2c_is_dead(h2c)) {
 		if (!(h2c->flags & (H2_CF_RCVD_SHUT|H2_CF_ERR_PENDING|H2_CF_ERROR))) {
 			/* Ensure idle-ping is activated before going to idle. */
 			if (eb_is_empty(&h2c->streams_by_id) &&