From 0eb60c5b4d95ce471f207b279a1f4de13df76aa5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20L=C3=A9caille?= Date: Mon, 19 Jul 2021 14:48:36 +0200 Subject: [PATCH] MINOR: quic: Add TX packets at the very last time to their tree. If we add TX packets to their trees before sending them, they may be detected as lost before being sent. This may make haproxy crash when it retreives the prepared packets from TX ring buffers, dereferencing them after they have been freed. --- src/xprt_quic.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/xprt_quic.c b/src/xprt_quic.c index 8340be6af..5bc3495d5 100644 --- a/src/xprt_quic.c +++ b/src/xprt_quic.c @@ -2221,6 +2221,7 @@ int qc_send_ppkts(struct qring *qr, struct ssl_sock_ctx *ctx) qc_set_timer(ctx); TRACE_PROTO("sent pkt", QUIC_EV_CONN_SPPKTS, ctx->conn, pkt); next_pkt = pkt->next; + eb64_insert(&pkt->pktns->tx.pkts, &pkt->pn_node); quic_tx_packet_refdec(pkt); } } @@ -3931,7 +3932,6 @@ static struct quic_tx_packet *qc_build_hdshk_pkt(unsigned char **pos, qc->path->prep_in_flight += pkt->len; } pkt->pktns = qel->pktns; - eb64_insert(&qel->pktns->tx.pkts, &pkt->pn_node); TRACE_LEAVE(QUIC_EV_CONN_HPKT, qc->conn, pkt); return pkt; @@ -4132,7 +4132,6 @@ static struct quic_tx_packet *qc_build_phdshk_apkt(unsigned char **pos, qc->path->prep_in_flight += pkt->len; } pkt->pktns = qel->pktns; - eb64_insert(&qel->pktns->tx.pkts, &pkt->pn_node); TRACE_LEAVE(QUIC_EV_CONN_PAPKT, qc->conn, pkt); return pkt;