git.99rst.org Git - openwrt-packages.git/blob

   1 commit d9a130e1962c2a5352f33088c563f4248a102c48
   2 Author: Willy Tarreau <w@1wt.eu>
   3 Date:   Fri Aug 24 15:48:59 2018 +0200
   4
   5     BUG/MEDIUM: mux_pt: dereference the connection with care in mux_pt_wake()
   6
   7     mux_pt_wake() calls data->wake() which can return -1 indicating that the
   8     connection was just destroyed. We need to check for this condition and
   9     immediately exit in this case otherwise we dereference a just freed
  10     connection. Note that this mainly happens on idle connections between
  11     two HTTP requests. It can have random implications between requests as
  12     it may lead a wrong connection's polling to be re-enabled or disabled
  13     for example, especially with threads.
  14
  15     This patch must be backported to 1.8.
  16
  17     (cherry picked from commit ad7f0ad1c3c9c541a4c315b24d4500405d1383ee)
  18     Signed-off-by: Willy Tarreau <w@1wt.eu>
  19
  20 diff --git a/src/mux_pt.c b/src/mux_pt.c
  21 index a68b9621..c43e30f2 100644
  22 --- a/src/mux_pt.c
  23 +++ b/src/mux_pt.c
  24 @@ -51,6 +51,9 @@ static int mux_pt_wake(struct connection *conn)
  25
  26         ret = cs->data_cb->wake ? cs->data_cb->wake(cs) : 0;
  27
  28 +       if (ret < 0)
  29 +               return ret;
  30 +
  31         /* If we had early data, and we're done with the handshake
  32          * then whe know the data are safe, and we can remove the flag.
  33          */