(trafficserver) branch master updated: Fix server entry cleanup after request tunnel setup (#13295)

[bneradt]

This is an automated email from the ASF dual-hosted git repository.

bneradt pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/trafficserver.git


The following commit(s) were added to refs/heads/master by this push:
     new a8daf9994f Fix server entry cleanup after request tunnel setup (#13295)
a8daf9994f is described below

commit a8daf9994faba16c3b4cbfe21e724d048124731f
Author: Brian Neradt <brian.ner...@gmail.com>
AuthorDate: Tue Jun 23 12:56:05 2026 -0500

    Fix server entry cleanup after request tunnel setup (#13295)
    
    A crash was observed while an HTTP/2 stream finished sending an
    origin request header and started the client request body tunnel:
    
        #0 HttpSM::state_send_server_request_header(...)
           at src/proxy/http/HttpSM.cc:2176
        #1 HttpSM::main_handler(...)
           at src/proxy/http/HttpSM.cc:2731
        #5 Http2Stream::signal_write_event(...)
           at src/proxy/http2/Http2Stream.cc:954
    
    The core had server_entry == nullptr at the vc_type check after the
    request-body tunnel setup. The tunnel can synchronously abort the chain
    and clean up the server VC before returning.
    
    This checks whether the server entry still exists after setting up the
    request body tunnel or transform tunnel. When setup already cleaned it
    up, the state handler stops before installing a response-read handler
    on a null entry.
---
 src/proxy/http/HttpSM.cc | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/proxy/http/HttpSM.cc b/src/proxy/http/HttpSM.cc
index 0439ee683e..e12b2c4f6d 100644
--- a/src/proxy/http/HttpSM.cc
+++ b/src/proxy/http/HttpSM.cc
@@ -2227,6 +2227,11 @@ HttpSM::state_send_server_request_header(int event, void 
*data)
           }
         }
       }
+      // The request body tunnel setup can synchronously abort the chain, which
+      // cleans up server_entry before returning here.
+      if (server_entry == nullptr) {
+        break;
+      }
       // Any other events to these read response
       if (server_entry->vc_type == HttpVC_t::SERVER_VC) {
         server_entry->vc_read_handler = 
&HttpSM::state_read_server_response_header;