BUG/MAJOR: mux-quic: do not crash on connection error after glitch threshold

When a glitch reported by the HTTP/3 parser (SETTINGS/GOAWAY parsing or
QPACK decoding error) reaches tune.quic.{fe,be}.sec.glitches-threshold,
_qcc_report_glitch() sets a connection error before the caller also
calls qcc_set_error() with h3c->err. The BUG_ON() on double call then
kills the process, remotely triggerable by any client.

Make qcc_set_error() keep the first error and ignore subsequent calls.

Introduced by commit 0d35f8d91 ("MINOR: h3: report glitch on RFC
violation") in 3.0-dev12. Must be backported to all stable versions
since 3.0.

diff --git a/src/mux_quic.c b/src/mux_quic.c
index 69315cba34f4b4f19aeed68d3d5643aa58d62c53..fa366d341f8621ed2cd2136f693b1d11452cd765 100644 (file)
--- a/src/mux_quic.c
+++ b/src/mux_quic.c
@@ -823,14 +823,14 @@ void qcc_notify_buf(struct qcc *qcc, uint64_t free_size)
 
 /* A fatal error is detected locally for <qcc> connection. It should be closed
  * with a CONNECTION_CLOSE using <err> code. Set <app> to true to indicate that
- * the code must be considered as an application level error. This function
- * must not be called more than once by connection. If <tevt> is non null, it
- * is used as a connection level termination event code.
+ * the code must be considered as an application level error.
  */
 void qcc_set_error(struct qcc *qcc, int err, int app, int tevt)
 {
-       /* This must not be called multiple times per connection. */
-       BUG_ON(qcc->flags & QC_CF_ERRL);
+       if (qcc->flags & QC_CF_ERRL) {
+               TRACE_STATE("connection already on error", QMUX_EV_QCC_ERR, qcc->conn);
+               return;
+       }
 
        TRACE_STATE("connection on error", QMUX_EV_QCC_ERR, qcc->conn);