From: Christopher Faulet <cfaulet@haproxy.com>
Date: Tue, 3 Nov 2020 08:11:43 +0000 (+0100)
Subject: BUG/MEDIUM: mux-pt: Release the tasklet during an HTTP upgrade
X-Git-Tag: v2.1.10~4
X-Git-Url: http://git.haproxy.org/?a=commitdiff_plain;h=aef36e7843916348bb0d10badff4e0775b33ca7b;p=haproxy-2.1.git

BUG/MEDIUM: mux-pt: Release the tasklet during an HTTP upgrade

When a TCP connection is upgraded to HTTP, the passthrough multiplexer owning
the client connection is detroyed and replaced by an HTTP multiplexer. When it
happens, the connection context is changed (it is in fact the mux itself). Thus,
when the mux-pt is destroyed, the connection is not released. But, only the
connection must be kept. Everything else concerning the mux must be
released. Especially, the tasklet used for I/O subscriptions. In this part,
there was a bug and the tasklet was never released.

This patch should fix the issue #935. It must be backported as far as 2.0.

(cherry picked from commit 5a7ca29061dbc5736b53d45b9561e71807a0d05a)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 827b4fc10101847da0953a556120884f96c38aa2)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
---

diff --git a/src/mux_pt.c b/src/mux_pt.c
index 2ac7d47..fa8943f 100644
--- a/src/mux_pt.c
+++ b/src/mux_pt.c
@@ -26,23 +26,31 @@ DECLARE_STATIC_POOL(pool_head_pt_ctx, "mux_pt", sizeof(struct mux_pt_ctx));
 
 static void mux_pt_destroy(struct mux_pt_ctx *ctx)
 {
-	/* The connection must be aattached to this mux to be released */
-	if (ctx && ctx->conn && ctx->conn->ctx == ctx) {
-		struct connection *conn = ctx->conn;
+	struct connection *conn = NULL;
+
+	if (ctx) {
+		/* The connection must be attached to this mux to be released */
+		if (ctx->conn && ctx->conn->ctx == ctx)
+			conn = ctx->conn;
 
-		conn_stop_tracking(conn);
-		conn_full_close(conn);
 		tasklet_free(ctx->wait_event.tasklet);
+
+		if (conn && ctx->wait_event.events != 0)
+			conn->xprt->unsubscribe(conn, conn->xprt_ctx, ctx->wait_event.events,
+						&ctx->wait_event);
+		pool_free(pool_head_pt_ctx, ctx);
+	}
+
+	if (conn) {
 		conn->mux = NULL;
 		conn->ctx = NULL;
+
+		conn_stop_tracking(conn);
+		conn_full_close(conn);
 		if (conn->destroy_cb)
 			conn->destroy_cb(conn);
-		/* We don't bother unsubscribing here, as we're about to destroy
-		 * both the connection and the mux_pt_ctx
-		 */
 		conn_free(conn);
 	}
-	pool_free(pool_head_pt_ctx, ctx);
 }
 
 /* Callback, used when we get I/Os while in idle mode */