From: Olivier Houchard <ohouchard@haproxy.com>
Date: Tue, 6 Oct 2026 16:18:49 +0000 (+0200)
Subject: BUG/MAJOR: mux-quic: do not crash on connection error after glitch threshold
X-Git-Tag: v3.5-dev10~123
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=19910335dc7513fdf2896c42f0d5a6283a7ab6f2;p=haproxy.git

BUG/MAJOR: mux-quic: do not crash on connection error after glitch threshold

When a glitch reported by the HTTP/3 parser (SETTINGS/GOAWAY parsing or
QPACK decoding error) reaches tune.quic.{fe,be}.sec.glitches-threshold,
_qcc_report_glitch() sets a connection error before the caller also
calls qcc_set_error() with h3c->err. The BUG_ON() on double call then
kills the process, remotely triggerable by any client.

Make qcc_set_error() keep the first error and ignore subsequent calls.

Introduced by commit 0d35f8d91 ("MINOR: h3: report glitch on RFC
violation") in 3.0-dev12. Must be backported to all stable versions
since 3.0.
---

diff --git a/src/mux_quic.c b/src/mux_quic.c
index 69315cba3..fa366d341 100644
--- a/src/mux_quic.c
+++ b/src/mux_quic.c
@@ -823,14 +823,14 @@ void qcc_notify_buf(struct qcc *qcc, uint64_t free_size)
 
 /* A fatal error is detected locally for <qcc> connection. It should be closed
  * with a CONNECTION_CLOSE using <err> code. Set <app> to true to indicate that
- * the code must be considered as an application level error. This function
- * must not be called more than once by connection. If <tevt> is non null, it
- * is used as a connection level termination event code.
+ * the code must be considered as an application level error.
  */
 void qcc_set_error(struct qcc *qcc, int err, int app, int tevt)
 {
-	/* This must not be called multiple times per connection. */
-	BUG_ON(qcc->flags & QC_CF_ERRL);
+	if (qcc->flags & QC_CF_ERRL) {
+		TRACE_STATE("connection already on error", QMUX_EV_QCC_ERR, qcc->conn);
+		return;
+	}
 
 	TRACE_STATE("connection on error", QMUX_EV_QCC_ERR, qcc->conn);