From 5a7ca29061dbc5736b53d45b9561e71807a0d05a Mon Sep 17 00:00:00 2001 From: Christopher Faulet Date: Tue, 3 Nov 2020 09:11:43 +0100 Subject: [PATCH] BUG/MEDIUM: mux-pt: Release the tasklet during an HTTP upgrade When a TCP connection is upgraded to HTTP, the passthrough multiplexer owning the client connection is detroyed and replaced by an HTTP multiplexer. When it happens, the connection context is changed (it is in fact the mux itself). Thus, when the mux-pt is destroyed, the connection is not released. But, only the connection must be kept. Everything else concerning the mux must be released. Especially, the tasklet used for I/O subscriptions. In this part, there was a bug and the tasklet was never released. This patch should fix the issue #935. It must be backported as far as 2.0. --- src/mux_pt.c | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-) diff --git a/src/mux_pt.c b/src/mux_pt.c index a9fe0091f..57c1b9ef4 100644 --- a/src/mux_pt.c +++ b/src/mux_pt.c @@ -26,23 +26,31 @@ DECLARE_STATIC_POOL(pool_head_pt_ctx, "mux_pt", sizeof(struct mux_pt_ctx)); static void mux_pt_destroy(struct mux_pt_ctx *ctx) { - /* The connection must be aattached to this mux to be released */ - if (ctx && ctx->conn && ctx->conn->ctx == ctx) { - struct connection *conn = ctx->conn; + struct connection *conn = NULL; + + if (ctx) { + /* The connection must be attached to this mux to be released */ + if (ctx->conn && ctx->conn->ctx == ctx) + conn = ctx->conn; + + tasklet_free(ctx->wait_event.tasklet); + + if (conn && ctx->wait_event.events != 0) + conn->xprt->unsubscribe(conn, conn->xprt_ctx, ctx->wait_event.events, + &ctx->wait_event); + pool_free(pool_head_pt_ctx, ctx); + } + + if (conn) { + conn->mux = NULL; + conn->ctx = NULL; conn_stop_tracking(conn); conn_full_close(conn); - tasklet_free(ctx->wait_event.tasklet); - conn->mux = NULL; - conn->ctx = NULL; if (conn->destroy_cb) conn->destroy_cb(conn); - /* We don't bother unsubscribing here, as we're about to destroy - * both the connection and the mux_pt_ctx - */ conn_free(conn); } - pool_free(pool_head_pt_ctx, ctx); } /* Callback, used when we get I/Os while in idle mode */