[master] 9a2a221 Fix the leaking req on failure to put a waiting-list session back in play in a way that does not lead to panics.

[Poul-Henning Kamp]

commit 9a2a221c713b7329231d7a1b9e996a4a41eedcf2
Author: Poul-Henning Kamp <phk at FreeBSD.org>
Date:   Mon Oct 20 12:21:31 2014 +0000

    Fix the leaking req on failure to put a waiting-list session back
    in play in a way that does not lead to panics.
    
    Spotted by:	Martin
    Fixes		#1607

diff --git a/bin/varnishd/cache/cache_hash.c b/bin/varnishd/cache/cache_hash.c
index 7fe3d86..2c5592f 100644
--- a/bin/varnishd/cache/cache_hash.c
+++ b/bin/varnishd/cache/cache_hash.c
@@ -533,13 +533,8 @@ hsh_rush(struct worker *wrk, struct objhead *oh)
 		AZ(req->wrk);
 		VTAILQ_REMOVE(&wl->list, req, w_list);
 		DSL(DBG_WAITINGLIST, req->vsl->wid, "off waiting list");
-		if (SES_ScheduleReq(req)) {
-			/*
-			 * We could not schedule the session, put it back.
-			 */
-			VTAILQ_INSERT_HEAD(&wl->list, req, w_list);
+		if (SES_ScheduleReq(req))
 			break;
-		}
 	}
 	if (VTAILQ_EMPTY(&wl->list)) {
 		oh->waitinglist = NULL;
diff --git a/bin/varnishd/cache/cache_session.c b/bin/varnishd/cache/cache_session.c
index 2532f12..ef3f11b 100644
--- a/bin/varnishd/cache/cache_session.c
+++ b/bin/varnishd/cache/cache_session.c
@@ -241,6 +241,7 @@ SES_ScheduleReq(struct req *req)
 	if (Pool_Task(pp->pool, &sp->task, POOL_QUEUE_FRONT)) {
 		AN (req->vcl);
 		VCL_Rel(&req->vcl);
+		SES_ReleaseReq(req);
 		SES_Delete(sp, SC_OVERLOAD, NAN);
 		return (1);
 	}