BUG/MEDIUM: h2: Remove the tasklet from the task list if unsubscribing.
In h2_unsubscribe(), if we unsubscribe on SUB_CALL_UNSUBSCRIBE, then remove
ourself from the sending_list, and remove the tasklet from the task list.
We're probably about to destroy the stream anyway, so we don't want the
tasklet to run, or to stay in the sending_list, or it could lead to a crash.
This should be backpored to 1.9.
diff --git a/src/mux_h2.c b/src/mux_h2.c
index f22e0e1..959bcfb 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -5182,9 +5182,11 @@
sw = param;
if (h2s->send_wait == sw) {
sw->events &= ~SUB_CALL_UNSUBSCRIBE;
+ task_remove_from_task_list((struct task *)h2s->send_wait->task);
h2s->send_wait = NULL;
LIST_DEL(&h2s->list);
LIST_INIT(&h2s->list);
+ LIST_DEL_INIT(&h2s->sending_list);
}
}
return 0;