tree 8f2eb16b838c8ee2f398c5e6cf82c6c8b7e540de
parent 393e4e4dd155a9553aaa7d6e0870d6cbfcaec9c0
author Amaury Denoyelle <adenoyelle@haproxy.com> 1670840562 +0100
committer Amaury Denoyelle <adenoyelle@haproxy.com> 1670841874 +0100

BUG/MINOR: quic: properly handle alloc failure in qc_new_conn()

qc_new_conn() is used to allocate a quic_conn instance and its various
internal members. If one allocation fails, quic_conn_release() is used
to cleanup things.

For the moment, pool_zalloc() is used which ensures that all content is
null. However, some members must be initialized to a special values
to be able to use quic_conn_release() safely. This is the case for
quic_conn lists and its tasklet.

Also, some quic_conn internal allocation functions were doing their own
cleanup on failure without reset to NULL. This caused an issue with
quic_conn_release() which also frees this members. To fix this, these
functions now only return an error without cleanup. It is the caller
responsibility to free the allocated content, which is done via
quic_conn_release().

Without this patch, allocation failure in qc_new_conn() would often
result in segfault. This was reproduced easily using fail-alloc at 10%.

This should be backported up to 2.6.