tree 4e0c321f441d98f7114c8f395c4519fba40e152f
parent 71049cce3f43a5a0c08af923f5fc9599dc0c453f
author Willy Tarreau <w@1wt.eu> 1522329779 +0200
committer Willy Tarreau <w@1wt.eu> 1522329779 +0200
encoding latin1

BUG/MEDIUM: h2/threads: never release the task outside of the task handler

Currently, h2_release() will release all resources assigned to the h2
connection, including the timeout task if any. But since the multi-threaded
scheduler, the timeout task could very well be queued in the thread-local
list of running tasks without any way to remove it, so task_delete() will
have no effect and task_free() will cause this undefined object to be
dereferenced.

In order to prevent this from happening, we never release the task in
h2_release(), instead we wake it up after marking its context NULL so that
the task handler can release the task.

Future improvements could consist in modifying the scheduler so that a
task_wakeup() has to be done on any task having to be killed, letting
the scheduler take care of it.

This fix must be backported to 1.8. This bug was apparently not reported
so far.