From cc043f66b7d6479866037bae00e27fd34fbee70b Mon Sep 17 00:00:00 2001 From: Christopher Faulet Date: Mon, 14 Dec 2020 10:06:12 +0100 Subject: [PATCH] BUG/MEDIUM: mux-h1: Fix a deadlock when a 408 error is pending for a client When a frontend H1 connection timed out waiting for the next request, a 408 error message is returned to the client. It is performed into the H1C task process function, h1_timeout_task(), and under the idle connection takeover lock. If the 408 error message cannot be sent immediately, we wait for a next retry. In this case, the lock must be released. This bug was introduced by the commit c4bfa59f1d ("MAJOR: mux-h1: Create the client stream as later as possible") and is specific to the 2.4-DEV. No backport needed. --- src/mux_h1.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/mux_h1.c b/src/mux_h1.c index adfe0e51c..f50b9d844 100644 --- a/src/mux_h1.c +++ b/src/mux_h1.c @@ -2589,6 +2589,7 @@ static struct task *h1_timeout_task(struct task *t, void *context, unsigned shor h1_send(h1c); if (b_data(&h1c->obuf) || (h1c->flags & H1C_F_ERR_PENDING)) { h1_refresh_timeout(h1c); + HA_SPIN_UNLOCK(OTHER_LOCK, &idle_conns[tid].takeover_lock); return t; } }