From 3c49c1bd5ce1b47baa63d3c4058437e341389d98 Mon Sep 17 00:00:00 2001 From: Olivier Houchard Date: Sun, 22 Mar 2020 19:56:03 +0100 Subject: [PATCH] BUG/MEDIUM: h1: Make sure we subscribe before going into idle list. In h1_detach(), make sure we subscribe before we call srv_add_to_idle_list(), not after. As soon as srv_add_to_idle_list() is called, and it is put in an idle list, another thread can take it, and we're no longer allowed to subscribe. This fixes a race condition when another thread grabs a connection as soon as it is put, the original owner would subscribe, and thus the new thread would fail to do so, and to activate polling. --- src/mux_h1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/mux_h1.c b/src/mux_h1.c index f4cf0ff84..fee645b19 100644 --- a/src/mux_h1.c +++ b/src/mux_h1.c @@ -2466,13 +2466,13 @@ static void h1_detach(struct conn_stream *cs) if (!(h1c->conn->flags & CO_FL_PRIVATE)) { if (h1c->conn->owner == sess) h1c->conn->owner = NULL; + h1c->conn->xprt->subscribe(h1c->conn, h1c->conn->xprt_ctx, SUB_RETRY_RECV, &h1c->wait_event); if (!srv_add_to_idle_list(objt_server(h1c->conn->target), h1c->conn, is_not_first)) { /* The server doesn't want it, let's kill the connection right away */ h1c->conn->mux->destroy(h1c); TRACE_DEVEL("outgoing connection killed", H1_EV_STRM_END|H1_EV_H1C_END); goto end; } - h1c->conn->xprt->subscribe(h1c->conn, h1c->conn->xprt_ctx, SUB_RETRY_RECV, &h1c->wait_event); return; } }