RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-02-14 17:37:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MEDIUM: mux_pt: Make sure we don't have a conn_stream before freeing.

Browse Source 
On error, make sure we don't have a conn_stream before freeing the connection
and the associated mux context. Otherwise a stream will still reference
the connection, and attempt to use it.
If we still have a conn_stream, it will properly be free'd when the detach
method is called, anyway.

This should be backported to 2.0 and 1.9.
This commit is contained in:
Olivier Houchard 2019-10-17 18:02:53 +02:00 committed by Olivier Houchard
parent 2068ec4f89
commit e8826ded5f
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/mux_pt.c
View File

@ -51,9 +51,10 @@ static struct task *mux_pt_io_cb(struct task *t, void *tctx, unsigned short stat
struct mux_pt_ctx *ctx = tctx; struct mux_pt_ctx *ctx = tctx;
conn_sock_drain(ctx->conn); conn_sock_drain(ctx->conn);
if (ctx->conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH)) if (ctx->conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH)) {
mux_pt_destroy(ctx); if (!ctx->cs)
else mux_pt_destroy(ctx);
} else
ctx->conn->xprt->subscribe(ctx->conn, ctx->conn->xprt_ctx, SUB_RETRY_RECV, ctx->conn->xprt->subscribe(ctx->conn, ctx->conn->xprt_ctx, SUB_RETRY_RECV,
&ctx->wait_event); &ctx->wait_event);
@ -193,7 +194,7 @@ static void mux_pt_detach(struct conn_stream *cs)
!(conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH))) { !(conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH))) {
ctx->cs = NULL; ctx->cs = NULL;
conn->xprt->subscribe(conn, conn->xprt_ctx, SUB_RETRY_RECV, &ctx->wait_event); conn->xprt->subscribe(conn, conn->xprt_ctx, SUB_RETRY_RECV, &ctx->wait_event);
} else } else if (!ctx->cs)
/* There's no session attached to that connection, destroy it */ /* There's no session attached to that connection, destroy it */
mux_pt_destroy(ctx); mux_pt_destroy(ctx);
} }