From dd58dff1e64fa382d368958469506c296454fde6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20L=C3=A9caille?= Date: Wed, 13 Dec 2023 11:45:43 +0100 Subject: [PATCH] BUG/MEDIUM: quic: QUIC CID removed from tree without locking This bug arrived with this commit: BUG/MINOR: quic: Wrong RETIRE_CONNECTION_ID sequence number chec Every connection ID manipulations against the by thread trees used to store the connection IDs must be done under the trees locks. These trees are accessed by the low level connection identification code. When receiving a RETIRE_CONNECTION_ID frame, the concerned connection ID must be deleted from the its underlying by thread tree but not without locking! Add a WR lock around ebmb_delete() call to do so. Must be backported as far as 2.7. --- src/quic_rx.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/quic_rx.c b/src/quic_rx.c index d136efdf8..9e55aa34e 100644 --- a/src/quic_rx.c +++ b/src/quic_rx.c @@ -996,6 +996,7 @@ static int qc_parse_pkt_frms(struct quic_conn *qc, struct quic_rx_packet *pkt, break; case QUIC_FT_RETIRE_CONNECTION_ID: { + struct quic_cid_tree *tree; struct quic_connection_id *conn_id = NULL; if (!qc_handle_retire_connection_id_frm(qc, &frm, &pkt->dcid, &conn_id)) @@ -1004,7 +1005,10 @@ static int qc_parse_pkt_frms(struct quic_conn *qc, struct quic_rx_packet *pkt, if (!conn_id) break; + tree = &quic_cid_trees[quic_cid_tree_idx(&conn_id->cid)]; + HA_RWLOCK_WRLOCK(QC_CID_LOCK, &tree->lock); ebmb_delete(&conn_id->node); + HA_RWLOCK_WRUNLOCK(QC_CID_LOCK, &tree->lock); eb64_delete(&conn_id->seq_num); pool_free(pool_head_quic_connection_id, conn_id); TRACE_PROTO("CID retired", QUIC_EV_CONN_PSTRM, qc);