mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2026-04-29 10:12:06 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MEDIUM: muxes: Make sure we unsubcribed when destroying mux ctx.

Browse Source 
In the h1 and h2 muxes, make sure we unsubscribed before destroying the
mux context.
Failing to do so will lead in a segfault later, as the connection will
attempt to dereference its conn->send_wait or conn->recv_wait, which pointed
to the now-free'd mux context.

This was introduced by commit 39a96ee16eeec51774f9f52a783cf624a0de4ccb, so
should only be backported if that commit gets backported.
This commit is contained in:
Olivier Houchard 2019-04-15 17:51:16 +02:00 committed by Olivier Houchard
parent e61828449c
commit 0e0793715c
2 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/mux_h1.c
View File

@ -483,6 +483,9 @@ static void h1_release(struct h1c *h1c)
tasklet_free(h1c->wait_event.task);
h1s_destroy(h1c->h1s);
if (conn && h1c->wait_event.events != 0)
conn->xprt->unsubscribe(conn, h1c->wait_event.events,
&h1c->wait_event);
pool_free(pool_head_h1c, h1c);
}
@ -490,7 +493,6 @@ static void h1_release(struct h1c *h1c)
conn->mux = NULL;
conn->ctx = NULL;
conn_force_unsubscribe(conn);
conn_stop_tracking(conn);
conn_full_close(conn);
if (conn->destroy_cb)

4
src/mux_h2.c
View File

@ -642,6 +642,9 @@ static void h2_release(struct h2c *h2c)
}
if (h2c->wait_event.task)
tasklet_free(h2c->wait_event.task);
if (h2c->wait_event.events != 0)
conn->xprt->unsubscribe(conn, h2c->wait_event.events,
&h2c->wait_event);
pool_free(pool_head_h2c, h2c);
}
@ -650,7 +653,6 @@ static void h2_release(struct h2c *h2c)
conn->mux = NULL;
conn->ctx = NULL;
conn_force_unsubscribe(conn);
conn_stop_tracking(conn);
conn_full_close(conn);
if (conn->destroy_cb)