tree 5b2d33a66579fc0afa7ed24b2a9012d411352dfd
parent 1d15f68a633f8b28a97327234b66969ced204bae
author Willy Tarreau <w@1wt.eu> 1588866416 +0200
committer Willy Tarreau <w@1wt.eu> 1588869588 +0200
encoding latin1

BUG/MEDIUM: backend: don't access a non-existing mux from a previous connection

In 2.0 and 1.9, there is a very difficult to trigger risk of crash which
happened after commit e8f5f5d8b2 ("BUG/MEDIUM: servers: Only set SF_SRV_REUSED
if the connection if fully ready.").

The problem is that if a first attempt to connect to a server using ALPN
fails to find a mux but the TLS handshake completes, we'll end up with
conn->mux==NULL and conn_xprt_ready() set. The stream retries and since
it already has a connection it reuses it. But this time it tries to check
if the mux is ready to mark that the connection was reused, except that
the mux was not set.

Let's make sure we don't evaluate all the remaining cases requiring the
mux in the if/else sequence by immediately leaving if it's not set. This
also helps removing some doubts when reading the code.

This fix is not in mainline and is not required in 2.1 and above because
we always start by releasing the previous connection in connect_server()
so such a case cannot happen. It must however be backported to 1.9 and
only 1.9.

Thanks to Olivier for explaining how this can happen.