From: Willy Tarreau <w@1wt.eu>
Date: Mon, 12 Oct 2026 12:38:34 +0000 (+0200)
Subject: [PATCH] BUG/MAJOR: mux-h2: properly handle short reads on PING frames
X-Git-Tag: archive/raspbian/2.6.12-1+rpi1+deb12u4^2~1
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=5320a627ad45a2328dfb0f8206cee21f274f65cb;p=haproxy.git

[PATCH] BUG/MAJOR: mux-h2: properly handle short reads on PING frames

Handling of partially received H2 frames was fixed in 2.5 with commit
b5f7b52968 ("BUG/MEDIUM: mux-h2: Handle remaining read0 cases on partial
frames"), however it turns out that the PING one was apparently missed.
However by then it was not a problem, but became one when commit 633c41c62
("MEDIUM: mux-h2: rework h2_restart_reading() to differentiate recv and
demux") was merged in 3.1 because now the mux's tasklet can properly wake
up as long as the job is not finished, which unfortunately doesn't play
well once combined with the fix above, because as long as the data are
not consumed, we continue to wake up, and we don't consume them until
the frame is complete, or the timeout http-request strikes.

Let's simply implement the check for the short read in h2c_handle_ping()
to avoid the spurious wakeup.

This needs to be backported to 3.2, maybe even 2.6 since the checks in
other functions didn't change since then.

As a workaround, setting "timeout http-request" to a low value such as
1-5s mitigates the CPU consumption.

(cherry picked from commit 7ddb55bc18744996782e9e2b50f16b9b985d766b)
Signed-off-by: Willy Tarreau <w@1wt.eu>

Gbp-Pq: Name 0001-BUG-MAJOR-mux-h2-properly-handle-short-reads-on-PING.patch
---

diff --git a/src/mux_h2.c b/src/mux_h2.c
index 65edcaa..0a4345e 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -2514,6 +2514,12 @@ static int h2c_ack_settings(struct h2c *h2c)
  */
 static int h2c_handle_ping(struct h2c *h2c)
 {
+	/* process full frame only */
+	if (b_data(&h2c->dbuf) < h2c->dfl) {
+		h2c->flags |= H2_CF_DEM_SHORT_READ;
+		return 0;
+	}
+
 	/* schedule a response */
 	if (!(h2c->dff & H2_F_PING_ACK))
 		h2c->st0 = H2_CS_FRAME_A;