From: Christopher Faulet <cfaulet@haproxy.com>
Date: Wed, 7 Oct 2026 14:05:00 +0000 (+0200)
Subject: BUG/MEDIUM: mux-h1: also release the embryonic stream when the error is empty
X-Git-Tag: v3.5-dev9~31
X-Git-Url: https://git.kaiwu.me/$%7BGITURL%7D/doc/static/gitweb.js?a=commitdiff_plain;h=e8ba1113cbc5b07265f97966abf43a67081b9d06;p=haproxy.git

BUG/MEDIUM: mux-h1: also release the embryonic stream when the error is empty

When an error (400, 408, 500, 501) must be returned by the H1 multiplexer
and the proxy's error message is mapped on /dev/null or an empty file,
h1_send_error() exits without testing for embryonic H1 stream to destroy
it. So the H1 stream remains attached, preventing the H1 connection to be
closed as expected. The H1 connection is only released when the client
timeout expires.

Let's place the label before the embryonic stream destruction, so that it
is also performed for empty errors.

This was introduced by commit 0d4271cda ("BUG/MEDIUM: mux-h1: Properly
handle empty message when an error is triggered") in 3.1-dev7, which was
tagged for backport as far as 2.8. This must be backported where it was.
---

diff --git a/src/mux_h1.c b/src/mux_h1.c
index 6f9ac7eed..0538088dd 100644
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -3854,13 +3854,13 @@ static int h1_send_error(struct h1c *h1c)
 		}
 	}
 
+  out_abort:
 	if (h1c->state == H1_CS_EMBRYONIC) {
 		BUG_ON(h1c->h1s == NULL || h1s_sc(h1c->h1s) != NULL);
 		TRACE_DEVEL("Abort embryonic H1S", H1_EV_H1C_ERR, h1c->conn, h1c->h1s);
 		h1s_destroy(h1c->h1s);
 	}
 
-  out_abort:
 	h1c->flags = (h1c->flags & ~(H1C_F_WAIT_NEXT_REQ|H1C_F_ABRT_PENDING)) | H1C_F_ABRTED;
 	h1_close(h1c);
   out: