Amaury Denoyelle 131f2d93e1 BUG/MINOR: mux-quic: do not free frame already released by quic-conn ...

MUX uses qc_send_mux() function to send frames list over a QUIC
connection. On network congestion, the lower layer will reject some
frames and it is the MUX responsibility to free them. There is another
category of error which are when the sendto() fails. In this case, the
lower layer will free the packet and its attached frames and the MUX
should not touch them.

This model was violated by MUX layer for RESET_STREAM and STOP_SENDING
emission. In this case, frames were freed every time by the MUX on
error. This causes a double free error which lead to a crash.

Fix this by always ensuring if frames were rejected by the lower layer
before freeing them on the MUX. This is done simply by checking if frame
list is not empty, as RESET_STREAM and STOP_SENDING are sent
individually.

This bug was never reproduced in production. Thus, it is labelled as
MINOR.

This must be backported up to 2.7.

2023-05-11 14:04:51 +02:00

..

acl.c

…

action.c

…

activity.c

…

applet.c

…

arg.c

…

auth.c

…

backend.c

…

base64.c

…

cache.c

…

calltrace.c

…

cbuf.c

…

cfgcond.c

…

cfgdiag.c

…

cfgparse-global.c

…

cfgparse-listen.c

…

cfgparse-quic.c

…

cfgparse-ssl.c

…

cfgparse-tcp.c

…

cfgparse-unix.c

…

cfgparse.c

…

channel.c

…

check.c

…

chunk.c

…

cli.c

…

clock.c

…

compression.c

…

connection.c

…

cpuset.c

…

debug.c

…

dgram.c

…

dict.c

…

dns.c

…

dynbuf.c

…

eb32sctree.c

…

eb32tree.c

…

eb64tree.c

…

ebimtree.c

…

ebistree.c

…

ebmbtree.c

…

ebpttree.c

…

ebsttree.c

…

ebtree.c

…

errors.c

…

ev_epoll.c

…

ev_evports.c

…

ev_kqueue.c

…

ev_poll.c

…

ev_select.c

…

event_hdl.c

…

extcheck.c

…

fcgi-app.c

…

fcgi.c

…

fd.c

…

filters.c

…

fix.c

…

flt_bwlim.c

…

flt_http_comp.c

…

flt_spoe.c

…

flt_trace.c

…

freq_ctr.c

…

frontend.c

…

h1_htx.c

…

h1.c

…

h2.c

…

h3_stats.c

…

h3.c

…

haproxy.c

…

hash.c

…

hlua_fcn.c

…

hlua.c

…

hpack-dec.c

…

hpack-enc.c

…

hpack-huff.c

…

hpack-tbl.c

…

hq_interop.c

…

http_acl.c

…

http_act.c

…

http_ana.c

…

http_client.c

…

http_conv.c

…

http_ext.c

…

http_fetch.c

…

http_htx.c

…

http_rules.c

…

http.c

…

htx.c

…

init.c

…

jwt.c

…

lb_chash.c

…

lb_fas.c

…

lb_fwlc.c

…

lb_fwrr.c

…

lb_map.c

…

listener.c

…

log.c

…

lru.c

…

mailers.c

…

map.c

…

mjson.c

…

mqtt.c

…

mux_fcgi.c

…

mux_h1.c

…

mux_h2.c

…

mux_pt.c

…

mux_quic.c

…

mworker-prog.c

…

mworker.c

…

namespace.c

…

ncbuf.c

…

pattern.c

…

payload.c

…

peers.c

…

pipe.c

…

pool.c

…

proto_quic.c

…

proto_sockpair.c

…

proto_tcp.c

…

proto_udp.c

…

proto_uxdg.c

…

proto_uxst.c

…

protocol.c

…

proxy.c

…

qmux_http.c

…

qmux_trace.c

…

qpack-dec.c

…

qpack-enc.c

…

qpack-tbl.c

…

queue.c

…

quic_cc_cubic.c

…

quic_cc_newreno.c

…

quic_cc_nocc.c

…

quic_cc.c

…

quic_conn.c

…

quic_frame.c

…

quic_loss.c

…

quic_sock.c

…

quic_stats.c

…

quic_stream.c

…

quic_tls.c

…

quic_tp.c

…

raw_sock.c

…

regex.c

…

resolvers.c

…

ring.c

…

sample.c

…

server_state.c

…

server.c

…

session.c

…

sha1.c

…

shctx.c

…

signal.c

…

sink.c

…

slz.c

…

sock_inet.c

…

sock_unix.c

…

sock.c

…

ssl_ckch.c

…

ssl_crtlist.c

…

ssl_ocsp.c

…

ssl_sample.c

…

ssl_sock.c

…

ssl_utils.c

…

stats.c

…

stconn.c

…

stick_table.c

…

stream.c

…

task.c

…

tcp_act.c

…

tcp_rules.c

…

tcp_sample.c

…

tcpcheck.c

…

thread.c

…

time.c

…

tools.c

…

trace.c

…

uri_auth.c

…

uri_normalizer.c

…

vars.c

…

version.c

…

wdt.c

…

xprt_handshake.c

…

xprt_quic.c

…