BUG/MEDIUM: h3: fix BUG_ON() crash with glitch on GOAWAY parsing

This patch fixes glitch reporting after GOAWAY frame parsing. Similar to
the previous commit, qcc_report_glitch() is called only after
qcc_set_error() after h3_parse_goaway_frm().

This must be backported up to 3.4.

diff --git a/src/h3.c b/src/h3.c
index 5481aaa941b976ecaf60504e1f5e6d0658bf3431..566819ad358dac50a7a9817d3519f3ae3b9085c5 100644 (file)
--- a/src/h3.c
+++ b/src/h3.c
@@ -1848,20 +1848,17 @@ static ssize_t h3_parse_goaway_frm(struct h3c *h3c, const struct buffer *buf,
                 */
                TRACE_ERROR("truncated GOAWAY frame", H3_EV_RX_FRAME, h3c->qcc->conn);
                h3c->err = H3_ERR_FRAME_ERROR;
-               qcc_report_glitch(h3c->qcc, 1);
                return -1;
        }
 
        if (ret != len) {
                TRACE_ERROR("mismatch on GOAWAY frame length", H3_EV_RX_FRAME, h3c->qcc->conn);
                h3c->err = H3_ERR_FRAME_ERROR;
-               qcc_report_glitch(h3c->qcc, 1);
                return -1;
        }
 
        if ((h3c->flags & H3_CF_GOAWAY_RECV) && id > h3c->id_shut_r) {
                h3c->err = H3_ERR_ID_ERROR;
-               qcc_report_glitch(h3c->qcc, 1);
                return -1;
        }
 
@@ -2180,6 +2177,7 @@ static ssize_t h3_rcv_buf(struct qcs *qcs, struct buffer *b, int fin)
                        if (ret < 0) {
                                TRACE_ERROR("error on GOAWAY parsing", H3_EV_RX_FRAME, qcs->qcc->conn, qcs);
                                qcc_set_error(qcs->qcc, h3c->err, 1, muxc_tevt_type_proto_err);
+                               qcc_report_glitch(h3c->qcc, 1);
                                goto err;
                        }
                        break;