From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Wed, 28 Oct 2026 10:20:11 +0000 (+0100)
Subject: BUG/MINOR: mux_quic: remove dangling qc->qcc ref on MUX init failure
X-Git-Tag: v3.5-dev12~31
X-Git-Url: https://git.kaiwu.me/%7B@url%7D?a=commitdiff_plain;h=af5707d48ea69feca3eb36ea59d02013ff3b5e9f;p=haproxy.git

BUG/MINOR: mux_quic: remove dangling qc->qcc ref on MUX init failure

During QUIC MUX init, the newly allocated QCC reference is stored in the
underlying quic_conn instance. If MUX init fails later, the reference is
not reset despite QCC being freed, and there is a risk that the
transport layer uses the dangling pointer.

Fix this by delaying the transport layer registration until every
fallible operations in MUX init has succeeded.

This must be backported up to 2.8.
---

diff --git a/src/mux_quic.c b/src/mux_quic.c
index a4e7f6a51..ba9d45999 100644
--- a/src/mux_quic.c
+++ b/src/mux_quic.c
@@ -4223,15 +4223,6 @@ static int qcm_init(struct connection *conn, struct proxy *prx,
 	qcc_reset_idle_start(qcc);
 	LIST_INIT(&qcc->opening_list);
 
-	if (conn_is_quic(conn)) {
-		HA_ATOMIC_STORE(&conn->handle.qc->qcc, qcc);
-	}
-	else {
-		/* Wakeup MUX immediately if data copied from XPRT layer. */
-		if (unlikely(b_data(&qcc->rx.qmux_buf)))
-			tasklet_wakeup(qcc->wait_event.tasklet);
-	}
-
 	/* Register conn as app_ops may use it. */
 	qcc->conn = conn;
 
@@ -4309,6 +4300,15 @@ static int qcm_init(struct connection *conn, struct proxy *prx,
 		qcc->tot_sc++;
 	}
 
+	if (conn_is_quic(conn)) {
+		HA_ATOMIC_STORE(&conn->handle.qc->qcc, qcc);
+	}
+	else {
+		/* Wakeup MUX immediately if data copied from XPRT layer. */
+		if (unlikely(b_data(&qcc->rx.qmux_buf)))
+			tasklet_wakeup(qcc->wait_event.tasklet);
+	}
+
 	TRACE_USER("init mux", QMUX_EV_QCC_NEW, conn);
 	TRACE_LEAVE(QMUX_EV_QCC_NEW, conn);
 	return 0;