From 4f38c4bfd8c07331258b4b13111a07c7b3013021 Mon Sep 17 00:00:00 2001 From: Frederic Lecaille Date: Tue, 21 Jan 2025 16:12:05 +0100 Subject: [PATCH] MINOR: quic: Add a BUG_ON() on quic_tx_packet refcount This is definitively a bug to call quic_tx_packet_refdec() to decrement the reference counter of a TX packet calling quic_tx_packet_refdec(), and possibly to release its memory when it is negative or null. This counter is incremented when a TX frm is attached to it with some allocated memory and when the packet is inserted into a data structure, if needed (list or tree). Should be easily backported as far as 2.6 to ease any further backport around this code part. --- include/haproxy/quic_tx.h | 1 + 1 file changed, 1 insertion(+) diff --git a/include/haproxy/quic_tx.h b/include/haproxy/quic_tx.h index 9961a2384..1be932230 100644 --- a/include/haproxy/quic_tx.h +++ b/include/haproxy/quic_tx.h @@ -76,6 +76,7 @@ static inline void quic_tx_packet_refinc(struct quic_tx_packet *pkt) /* Decrement the reference counter of */ static inline void quic_tx_packet_refdec(struct quic_tx_packet *pkt) { + BUG_ON(pkt->refcnt <= 0); if (--pkt->refcnt == 0) { BUG_ON(!LIST_ISEMPTY(&pkt->frms)); /* If there are others packet in the same datagram is attached to, -- 2.47.3