BUG/MINOR: mux_quic: remove dangling qc->qcc ref on MUX init failure

During QUIC MUX init, the newly allocated QCC reference is stored in the
underlying quic_conn instance. If MUX init fails later, the reference is
not reset despite QCC being freed, and there is a risk that the
transport layer uses the dangling pointer.

Fix this by delaying the transport layer registration until every
fallible operations in MUX init has succeeded.

This must be backported up to 2.8.

diff --git a/src/mux_quic.c b/src/mux_quic.c
index a4e7f6a5193f8bd0e79d409ab51f750ce5f2c768..ba9d4599973db12999dadd1724b52310f51a61c3 100644 (file)
--- a/src/mux_quic.c
+++ b/src/mux_quic.c
@@ -4223,15 +4223,6 @@ static int qcm_init(struct connection *conn, struct proxy *prx,
        qcc_reset_idle_start(qcc);
        LIST_INIT(&qcc->opening_list);
 
-       if (conn_is_quic(conn)) {
-               HA_ATOMIC_STORE(&conn->handle.qc->qcc, qcc);
-       }
-       else {
-               /* Wakeup MUX immediately if data copied from XPRT layer. */
-               if (unlikely(b_data(&qcc->rx.qmux_buf)))
-                       tasklet_wakeup(qcc->wait_event.tasklet);
-       }
-
        /* Register conn as app_ops may use it. */
        qcc->conn = conn;
 
@@ -4309,6 +4300,15 @@ static int qcm_init(struct connection *conn, struct proxy *prx,
                qcc->tot_sc++;
        }
 
+       if (conn_is_quic(conn)) {
+               HA_ATOMIC_STORE(&conn->handle.qc->qcc, qcc);
+       }
+       else {
+               /* Wakeup MUX immediately if data copied from XPRT layer. */
+               if (unlikely(b_data(&qcc->rx.qmux_buf)))
+                       tasklet_wakeup(qcc->wait_event.tasklet);
+       }
+
        TRACE_USER("init mux", QMUX_EV_QCC_NEW, conn);
        TRACE_LEAVE(QMUX_EV_QCC_NEW, conn);
        return 0;