From: Christopher Faulet <cfaulet@haproxy.com>
Date: Fri, 16 Oct 2026 14:17:36 +0000 (+0200)
Subject: BUG/MINOR: mux-h1: Don't subscribe for receives once read0 or error received
X-Git-Tag: v3.5-dev10~130
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=50d20c9b8992ae25d37a381a7f5e8b643504b1f9;p=haproxy.git

BUG/MINOR: mux-h1: Don't subscribe for receives once read0 or error received

In h1_rcv_buf(), we no longer subscribe for reads once a read0 or an error
was received. Nothing can be read anymore, and the subscription itself is
useless. In addition, since the socket remains readable at EOF, the
connection could theoretically be woken up again and again, waking the
stream up in turn, which would make the process spin until the server
responds. No reliable reproducer was found for this, but it is safer to
not subscribe for reads when no more data can ever be received.

This patch could be backported to all supported versions.
---

diff --git a/src/mux_h1.c b/src/mux_h1.c
index 14dcea35d..108ba8bcc 100644
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -5003,7 +5003,8 @@ static size_t h1_rcv_buf(struct stconn *sc, struct buffer *buf, size_t count, in
 		TRACE_STATE("Block xprt rcv_buf to flush stream's buffer (want_fastfwd)", H1_EV_STRM_RECV, h1c->conn, h1s);
 	}
 	else {
-		if (((flags & CO_RFL_KEEP_RECV) || (h1m->state != H1_MSG_DONE)) && !(h1c->wait_event.events & SUB_RETRY_RECV))
+		if (((flags & CO_RFL_KEEP_RECV) || (h1m->state != H1_MSG_DONE)) && !(h1c->wait_event.events & SUB_RETRY_RECV) &&
+		    !(h1c->flags & (H1C_F_EOS|H1C_F_ERROR)))
 			h1c->conn->xprt->subscribe(h1c->conn, h1c->conn->xprt_ctx, SUB_RETRY_RECV, &h1c->wait_event);
 	}