From af5707d48ea69feca3eb36ea59d02013ff3b5e9f Mon Sep 17 00:00:00 2001 From: Amaury Denoyelle Date: Wed, 28 Oct 2026 11:20:11 +0100 Subject: [PATCH] BUG/MINOR: mux_quic: remove dangling qc->qcc ref on MUX init failure During QUIC MUX init, the newly allocated QCC reference is stored in the underlying quic_conn instance. If MUX init fails later, the reference is not reset despite QCC being freed, and there is a risk that the transport layer uses the dangling pointer. Fix this by delaying the transport layer registration until every fallible operations in MUX init has succeeded. This must be backported up to 2.8. --- src/mux_quic.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/src/mux_quic.c b/src/mux_quic.c index a4e7f6a51..ba9d45999 100644 --- a/src/mux_quic.c +++ b/src/mux_quic.c @@ -4223,15 +4223,6 @@ static int qcm_init(struct connection *conn, struct proxy *prx, qcc_reset_idle_start(qcc); LIST_INIT(&qcc->opening_list); - if (conn_is_quic(conn)) { - HA_ATOMIC_STORE(&conn->handle.qc->qcc, qcc); - } - else { - /* Wakeup MUX immediately if data copied from XPRT layer. */ - if (unlikely(b_data(&qcc->rx.qmux_buf))) - tasklet_wakeup(qcc->wait_event.tasklet); - } - /* Register conn as app_ops may use it. */ qcc->conn = conn; @@ -4309,6 +4300,15 @@ static int qcm_init(struct connection *conn, struct proxy *prx, qcc->tot_sc++; } + if (conn_is_quic(conn)) { + HA_ATOMIC_STORE(&conn->handle.qc->qcc, qcc); + } + else { + /* Wakeup MUX immediately if data copied from XPRT layer. */ + if (unlikely(b_data(&qcc->rx.qmux_buf))) + tasklet_wakeup(qcc->wait_event.tasklet); + } + TRACE_USER("init mux", QMUX_EV_QCC_NEW, conn); TRACE_LEAVE(QMUX_EV_QCC_NEW, conn); return 0; -- 2.47.3