From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Mon, 5 Oct 2026 15:42:18 +0000 (+0200)
Subject: BUG/MINOR: ssl: fix trace crash on FE conn release in io cb
X-Git-Tag: v3.5-dev9~200
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=f4d65a96d74e21595c0e745137f1eba35adef59c;p=haproxy.git

BUG/MINOR: ssl: fix trace crash on FE conn release in io cb

The following patch has added an output parameter in conn_create_mux()
to report if the connection has been destroyed. This can happen for
frontend connection only.

In case the connection is destroyed, tasklet is set to NULL as expected
to avoid returning an invalid pointer. However, conn pointer is left
unchanged. This leads to a crash if traces are activated. The proper fix
is to also set conn to NULL.

This must be backported up to 3.2.
---

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index fabb0b5ff..d45547eb4 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -7451,8 +7451,10 @@ struct task *ssl_sock_io_cb(struct task *t, void *context, unsigned int state)
 				if (ret < 0)
 					closed_connection = 1;
 			}
-			if (closed_connection)
+			if (closed_connection) {
+				conn = NULL;
 				t = NULL;
+			}
 			goto leave;
 		}
 	}