BUG/MEDIUM: mux-h2: make sure not to move a dead connection to idle

In h2_detach(), it looks possible to place a dead connection back to
the idle list, and to later call h2_release() on it once detected as
dead. It's not certain that it happens but nothing in the code shows
it is not possible, so better make sure it cannot happen.

This should be preventively backported to all versions.
This commit is contained in:
Willy Tarreau 2025-11-05 08:46:33 +01:00
parent 0799fd1072
commit 59c599f3f0

View File

@ -5577,7 +5577,7 @@ static void h2_detach(struct sedesc *sd)
h2s_destroy(h2s);
if (h2c->flags & H2_CF_IS_BACK) {
if (h2c->flags & H2_CF_IS_BACK && !h2c_is_dead(h2c)) {
if (!(h2c->flags & (H2_CF_RCVD_SHUT|H2_CF_ERR_PENDING|H2_CF_ERROR))) {
/* Ensure idle-ping is activated before going to idle. */
if (eb_is_empty(&h2c->streams_by_id) &&