RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-03-11 05:48:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MINOR: mux-quic: do not free frame already released by quic-conn

Browse Source 
MUX uses qc_send_mux() function to send frames list over a QUIC
connection. On network congestion, the lower layer will reject some
frames and it is the MUX responsibility to free them. There is another
category of error which are when the sendto() fails. In this case, the
lower layer will free the packet and its attached frames and the MUX
should not touch them.

This model was violated by MUX layer for RESET_STREAM and STOP_SENDING
emission. In this case, frames were freed every time by the MUX on
error. This causes a double free error which lead to a crash.

Fix this by always ensuring if frames were rejected by the lower layer
before freeing them on the MUX. This is done simply by checking if frame
list is not empty, as RESET_STREAM and STOP_SENDING are sent
individually.

This bug was never reproduced in production. Thus, it is labelled as
MINOR.

This must be backported up to 2.7.
This commit is contained in:
Amaury Denoyelle 2023-05-09 14:10:55 +02:00
parent 3fd40935d9
commit 131f2d93e1
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/mux_quic.c
View File

@ -1715,6 +1715,7 @@ static int qcs_send_reset(struct qcs *qcs)
LIST_APPEND(&frms, &frm->list);
if (qc_send_frames(qcs->qcc, &frms)) {
if (!LIST_ISEMPTY(&frms))
qc_frm_free(&frm);
TRACE_DEVEL("cannot send RESET_STREAM", QMUX_EV_QCS_SEND, qcs->qcc->conn, qcs);
return 1;
@ -1770,6 +1771,7 @@ static int qcs_send_stop_sending(struct qcs *qcs)
LIST_APPEND(&frms, &frm->list);
if (qc_send_frames(qcs->qcc, &frms)) {
if (!LIST_ISEMPTY(&frms))
qc_frm_free(&frm);
TRACE_DEVEL("cannot send STOP_SENDING", QMUX_EV_QCS_SEND, qcs->qcc->conn, qcs);
return 1;