This is an automated email from the ASF dual-hosted git repository. cmcfarlen pushed a commit to branch 10.1.x in repository https://gitbox.apache.org/repos/asf/trafficserver.git
commit b8dc80aecc5ec73535528e09211328155538bd50 Author: Brian Neradt <[email protected]> AuthorDate: Tue Jun 23 12:56:05 2026 -0500 Fix server entry cleanup after request tunnel setup (#13295) A crash was observed while an HTTP/2 stream finished sending an origin request header and started the client request body tunnel: #0 HttpSM::state_send_server_request_header(...) at src/proxy/http/HttpSM.cc:2176 #1 HttpSM::main_handler(...) at src/proxy/http/HttpSM.cc:2731 #5 Http2Stream::signal_write_event(...) at src/proxy/http2/Http2Stream.cc:954 The core had server_entry == nullptr at the vc_type check after the request-body tunnel setup. The tunnel can synchronously abort the chain and clean up the server VC before returning. This checks whether the server entry still exists after setting up the request body tunnel or transform tunnel. When setup already cleaned it up, the state handler stops before installing a response-read handler on a null entry. (cherry picked from commit a8daf9994faba16c3b4cbfe21e724d048124731f) --- src/proxy/http/HttpSM.cc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/proxy/http/HttpSM.cc b/src/proxy/http/HttpSM.cc index 7a9c3bc8a5..57530b2884 100644 --- a/src/proxy/http/HttpSM.cc +++ b/src/proxy/http/HttpSM.cc @@ -2129,6 +2129,11 @@ HttpSM::state_send_server_request_header(int event, void *data) } } } + // The request body tunnel setup can synchronously abort the chain, which + // cleans up server_entry before returning here. + if (server_entry == nullptr) { + break; + } // Any other events to these read response if (server_entry->vc_type == HTTP_SERVER_VC) { server_entry->vc_read_handler = &HttpSM::state_read_server_response_header;
