From 59c599f3f07c549c195f1bd877d2c2a09e6bc61f Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Wed, 5 Nov 2025 08:46:33 +0100 Subject: [PATCH] BUG/MEDIUM: mux-h2: make sure not to move a dead connection to idle In h2_detach(), it looks possible to place a dead connection back to the idle list, and to later call h2_release() on it once detected as dead. It's not certain that it happens but nothing in the code shows it is not possible, so better make sure it cannot happen. This should be preventively backported to all versions. --- src/mux_h2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/mux_h2.c b/src/mux_h2.c index a5232d0ca..ab2e5bfe9 100644 --- a/src/mux_h2.c +++ b/src/mux_h2.c @@ -5577,7 +5577,7 @@ static void h2_detach(struct sedesc *sd) h2s_destroy(h2s); - if (h2c->flags & H2_CF_IS_BACK) { + if (h2c->flags & H2_CF_IS_BACK && !h2c_is_dead(h2c)) { if (!(h2c->flags & (H2_CF_RCVD_SHUT|H2_CF_ERR_PENDING|H2_CF_ERROR))) { /* Ensure idle-ping is activated before going to idle. */ if (eb_is_empty(&h2c->streams_by_id) && -- 2.47.3