From 184f16ded7a0274bffe99a4795d0a27f8be7c006 Mon Sep 17 00:00:00 2001 From: Christopher Faulet Date: Thu, 1 Aug 2024 16:22:41 +0200 Subject: [PATCH] BUG/MEDIUM: mux-h2: Propagate term flags to SE on error in h2s_wake_one_stream When a stream is explicitly woken up by the H2 conneciton, if an error condition is detected, the corresponding error flag is set on the SE. So SE_FL_ERROR or SE_FL_ERR_PENDING, depending if the end of stream was reported or not. However, there is no attempt to propagate other termination flags. We must be sure to properly set SE_FL_EOI and SE_FL_EOS when appropriate to be able to switch a pending error to a fatal error. Because of this bug, the SE remains with a pending error and no end of stream, preventing the applicative stream to trully abort it. It means on some abort scenario, it is possible to block a stream infinitely. This patch must be backported at least as far as 2.8. No bug was observed on older versions while the same code is inuse. --- src/mux_h2.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/mux_h2.c b/src/mux_h2.c index 5d9bb20e9..8b670df64 100644 --- a/src/mux_h2.c +++ b/src/mux_h2.c @@ -2274,6 +2274,7 @@ static void h2s_wake_one_stream(struct h2s *h2s) (h2s->h2c->st0 >= H2_CS_ERROR || (h2s->h2c->flags & H2_CF_ERROR) || (h2s->h2c->last_sid > 0 && (!h2s->id || h2s->id > h2s->h2c->last_sid)))) { se_fl_set_error(h2s->sd); + h2s_propagate_term_flags(h2c, h2s); if (h2s->st < H2_SS_ERROR) h2s->st = H2_SS_ERROR;