[4.0] 795bc31 Fix the leaking req on failure to put a waiting-list session back in play in a way that does not lead to panics.

[Lasse Karstensen]

commit 795bc31f168ae64a30d1e61d01bd4e69f0016092
Author: Poul-Henning Kamp <phk at FreeBSD.org>
Date:   Mon Oct 20 12:21:31 2014 +0000

    Fix the leaking req on failure to put a waiting-list session back
    in play in a way that does not lead to panics.
    
    Spotted by:	Martin
    Fixes		#1607

diff --git a/bin/varnishd/cache/cache_hash.c b/bin/varnishd/cache/cache_hash.c
index 0a94a3d..47f346f 100644
--- a/bin/varnishd/cache/cache_hash.c
+++ b/bin/varnishd/cache/cache_hash.c
@@ -535,13 +535,8 @@ hsh_rush(struct dstat *ds, struct objhead *oh)
 		AZ(req->wrk);
 		VTAILQ_REMOVE(&wl->list, req, w_list);
 		DSL(DBG_WAITINGLIST, req->vsl->wid, "off waiting list");
-		if (SES_ScheduleReq(req)) {
-			/*
-			 * We could not schedule the session, put it back.
-			 */
-			VTAILQ_INSERT_HEAD(&wl->list, req, w_list);
+		if (SES_ScheduleReq(req))
 			break;
-		}
 	}
 	if (VTAILQ_EMPTY(&wl->list)) {
 		oh->waitinglist = NULL;
diff --git a/bin/varnishd/cache/cache_session.c b/bin/varnishd/cache/cache_session.c
index 7291a98..4ba15b6 100644
--- a/bin/varnishd/cache/cache_session.c
+++ b/bin/varnishd/cache/cache_session.c
@@ -237,6 +237,7 @@ SES_ScheduleReq(struct req *req)
 	if (Pool_Task(pp->pool, &sp->task, POOL_QUEUE_FRONT)) {
 		AN (req->vcl);
 		VCL_Rel(&req->vcl);
+		SES_ReleaseReq(req);
 		SES_Delete(sp, SC_OVERLOAD, NAN);
 		return (1);
 	}