From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Tue, 20 Oct 2026 09:03:21 +0000 (+0200)
Subject: Revert "BUG/MAJOR: mux-quic: do not crash on connection error after glitch threshold"
X-Git-Tag: v3.5-dev10~108
X-Git-Url: https://git.kaiwu.me/$%7BISSUES%7D/static/gitweb.js?a=commitdiff_plain;h=59d153a2f9cb2f5f47fb3043ec0b281ff0755a8f;p=haproxy.git

Revert "BUG/MAJOR: mux-quic: do not crash on connection error after glitch threshold"

This reverts commit 19910335dc7513fdf2896c42f0d5a6283a7ab6f2.

The same bug that this patch fixed was also corrected via the following
serie. For now, keep the BUG_ON() in qcc_set_error() to detect incorrect
usages.

f739a0c37 BUG/MEDIUM: h3: fix BUG_ON() crash with glitch after QPACK dec err
fc9a503b1 BUG/MEDIUM: h3: fix BUG_ON() crash with glitch on GOAWAY parsing
15d9a2f32 BUG/MEDIUM: h3: fix BUG_ON() crash with glitch on SETTINGS parsing
8eb164e14 MINOR: h3: remove dead code on h3_rcv_buf() error path
745b12086 BUG/MINOR: h3: fix risk of BUG_ON() crash with glitch on unknown frame
c2d82a20b  BUG/MINOR: h3: fix BUG_ON() crash with glitch on htx_set_eom() failure
---

diff --git a/src/mux_quic.c b/src/mux_quic.c
index fa366d341..69315cba3 100644
--- a/src/mux_quic.c
+++ b/src/mux_quic.c
@@ -823,14 +823,14 @@ void qcc_notify_buf(struct qcc *qcc, uint64_t free_size)
 
 /* A fatal error is detected locally for <qcc> connection. It should be closed
  * with a CONNECTION_CLOSE using <err> code. Set <app> to true to indicate that
- * the code must be considered as an application level error.
+ * the code must be considered as an application level error. This function
+ * must not be called more than once by connection. If <tevt> is non null, it
+ * is used as a connection level termination event code.
  */
 void qcc_set_error(struct qcc *qcc, int err, int app, int tevt)
 {
-	if (qcc->flags & QC_CF_ERRL) {
-		TRACE_STATE("connection already on error", QMUX_EV_QCC_ERR, qcc->conn);
-		return;
-	}
+	/* This must not be called multiple times per connection. */
+	BUG_ON(qcc->flags & QC_CF_ERRL);
 
 	TRACE_STATE("connection on error", QMUX_EV_QCC_ERR, qcc->conn);