BUG/MEDIUM: mux-pt: Release the tasklet during an HTTP upgrade
When a TCP connection is upgraded to HTTP, the passthrough multiplexer owning
the client connection is detroyed and replaced by an HTTP multiplexer. When it
happens, the connection context is changed (it is in fact the mux itself). Thus,
when the mux-pt is destroyed, the connection is not released. But, only the
connection must be kept. Everything else concerning the mux must be
released. Especially, the tasklet used for I/O subscriptions. In this part,
there was a bug and the tasklet was never released.
This patch should fix the issue #935. It must be backported as far as 2.0.
diff --git a/src/mux_pt.c b/src/mux_pt.c
index a9fe009..57c1b9e 100644
--- a/src/mux_pt.c
+++ b/src/mux_pt.c
@@ -26,23 +26,31 @@
static void mux_pt_destroy(struct mux_pt_ctx *ctx)
{
- /* The connection must be aattached to this mux to be released */
- if (ctx && ctx->conn && ctx->conn->ctx == ctx) {
- struct connection *conn = ctx->conn;
+ struct connection *conn = NULL;
- conn_stop_tracking(conn);
- conn_full_close(conn);
+ if (ctx) {
+ /* The connection must be attached to this mux to be released */
+ if (ctx->conn && ctx->conn->ctx == ctx)
+ conn = ctx->conn;
+
tasklet_free(ctx->wait_event.tasklet);
+
+ if (conn && ctx->wait_event.events != 0)
+ conn->xprt->unsubscribe(conn, conn->xprt_ctx, ctx->wait_event.events,
+ &ctx->wait_event);
+ pool_free(pool_head_pt_ctx, ctx);
+ }
+
+ if (conn) {
conn->mux = NULL;
conn->ctx = NULL;
+
+ conn_stop_tracking(conn);
+ conn_full_close(conn);
if (conn->destroy_cb)
conn->destroy_cb(conn);
- /* We don't bother unsubscribing here, as we're about to destroy
- * both the connection and the mux_pt_ctx
- */
conn_free(conn);
}
- pool_free(pool_head_pt_ctx, ctx);
}
/* Callback, used when we get I/Os while in idle mode */