BUG/MEDIUM: backend: don't access a non-existing mux from a previous connection
In 2.0 and 1.9, there is a very difficult to trigger risk of crash which
happened after commit e8f5f5d8b2 ("BUG/MEDIUM: servers: Only set SF_SRV_REUSED
if the connection if fully ready.").
The problem is that if a first attempt to connect to a server using ALPN
fails to find a mux but the TLS handshake completes, we'll end up with
conn->mux==NULL and conn_xprt_ready() set. The stream retries and since
it already has a connection it reuses it. But this time it tries to check
if the mux is ready to mark that the connection was reused, except that
the mux was not set.
Let's make sure we don't evaluate all the remaining cases requiring the
mux in the if/else sequence by immediately leaving if it's not set. This
also helps removing some doubts when reading the code.
This fix is not in mainline and is not required in 2.1 and above because
we always start by releasing the previous connection in connect_server()
so such a case cannot happen. It must however be backported to 1.9 and
only 1.9.
Thanks to Olivier for explaining how this can happen.
diff --git a/src/backend.c b/src/backend.c
index ae0943e..627a4b2 100644
--- a/src/backend.c
+++ b/src/backend.c
@@ -1558,6 +1558,12 @@
srv_conn->flags |= CO_FL_SOCKS4;
}
}
+ else if (!srv_conn->mux) {
+ /* No mux? We possibly asked for ALPN during a first failed
+ * attempt and are trying to start again from this connection,
+ * thus we have nothing to do.
+ */
+ }
else if (!conn_xprt_ready(srv_conn)) {
if (srv_conn->mux->reset)
srv_conn->mux->reset(srv_conn);