BUG/MEDIUM: quic: free stream_desc on all data acked
authorAmaury Denoyelle <adenoyelle@haproxy.com>
Wed, 7 May 2025 15:08:42 +0000 (17:08 +0200)
committerWilly Tarreau <w@1wt.eu>
Thu, 15 May 2025 15:01:43 +0000 (17:01 +0200)
The following patch simplifies qc_stream_desc_ack(). The qc_stream_desc
instance is not freed anymore, even if all data were acknowledged. As
implies by the commit message, the caller is responsible to perform this
cleaning operation.
  f4a83fbb14bdd14ed94752a2280a2f40c1b690d2
  MINOR: quic: do not remove qc_stream_desc automatically on ACK handling

However, despite the commit instruction, qc_stream_desc_free()
invokation was not moved in the caller. This commit fixes this by adding
it after stream ACK handling. This is performed only when a transfer is
completed : all data is acknowledged and qc_stream_desc has been
released by its MUX stream instance counterpart.

This bug may cause a significant increase in memory usage when dealing
with long running connection. However, there is no memory leak, as every
qc_stream_desc attached to a connection are finally freed when quic_conn
instance is released.

This must be backported up to 3.1.

(cherry picked from commit 3fdb039a99cdee543f4bbbfc983a51eb18f7f1f0)
Signed-off-by: Willy Tarreau <w@1wt.eu>

src/quic_rx.c

index 27eebec..a6c7057 100644 (file)
@@ -246,7 +246,10 @@ static int qc_handle_newly_acked_frm(struct quic_conn *qc, struct quic_frame *fr
                                            QUIC_EV_CONN_ACKSTRM, qc, strm_frm, stream);
 
                                if (qc_stream_desc_done(stream)) {
-                                       /* no need to continue if stream freed. */
+                                       /* Free qc_stream_desc instance as transfer is now completed. */
+                                       qc_stream_desc_free(stream, 0);
+                                       stream = NULL;
+
                                        TRACE_DEVEL("stream released and freed", QUIC_EV_CONN_ACKSTRM, qc);
                                        qc_check_close_on_released_mux(qc);
                                }