This is an automated email from the ASF dual-hosted git repository. cmcfarlen pushed a commit to branch 10.2.x in repository https://gitbox.apache.org/repos/asf/trafficserver.git
commit 70a24482442395d7dea8f408b61d38e614b92dae Author: Brian Neradt <[email protected]> AuthorDate: Tue Jun 23 12:56:05 2026 -0500 Fix server entry cleanup after request tunnel setup (#13295) A crash was observed while an HTTP/2 stream finished sending an origin request header and started the client request body tunnel: #0 HttpSM::state_send_server_request_header(...) at src/proxy/http/HttpSM.cc:2176 #1 HttpSM::main_handler(...) at src/proxy/http/HttpSM.cc:2731 #5 Http2Stream::signal_write_event(...) at src/proxy/http2/Http2Stream.cc:954 The core had server_entry == nullptr at the vc_type check after the request-body tunnel setup. The tunnel can synchronously abort the chain and clean up the server VC before returning. This checks whether the server entry still exists after setting up the request body tunnel or transform tunnel. When setup already cleaned it up, the state handler stops before installing a response-read handler on a null entry. (cherry picked from commit a8daf9994faba16c3b4cbfe21e724d048124731f) --- src/proxy/http/HttpSM.cc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/proxy/http/HttpSM.cc b/src/proxy/http/HttpSM.cc index 33480ae4a9..d884a639d5 100644 --- a/src/proxy/http/HttpSM.cc +++ b/src/proxy/http/HttpSM.cc @@ -2227,6 +2227,11 @@ HttpSM::state_send_server_request_header(int event, void *data) } } } + // The request body tunnel setup can synchronously abort the chain, which + // cleans up server_entry before returning here. + if (server_entry == nullptr) { + break; + } // Any other events to these read response if (server_entry->vc_type == HttpVC_t::SERVER_VC) { server_entry->vc_read_handler = &HttpSM::state_read_server_response_header;
