[master] a806b0c Final H2 bugfix before 5.1: Don't accidentally rip the session out because of a H1 assumption in transport-independent code.

[Poul-Henning Kamp]

commit a806b0c7f16b0f26c2b0b3812e7c936bf24ec9d2
Author: Poul-Henning Kamp <phk at FreeBSD.org>
Date:   Wed Mar 15 07:49:42 2017 +0000

    Final H2 bugfix before 5.1:  Don't accidentally rip the session out
    because of a H1 assumption in transport-independent code.

diff --git a/bin/varnishd/cache/cache.h b/bin/varnishd/cache/cache.h
index 7db4280..c45cc5e 100644
--- a/bin/varnishd/cache/cache.h
+++ b/bin/varnishd/cache/cache.h
@@ -930,7 +930,7 @@ void VRG_dorange(struct req *req, const char *r);
 /* cache_req.c */
 struct req *Req_New(const struct worker *, struct sess *);
 void Req_Release(struct req *);
-int Req_Cleanup(struct sess *sp, struct worker *wrk, struct req *req);
+void Req_Cleanup(struct sess *sp, struct worker *wrk, struct req *req);
 void Req_Fail(struct req *req, enum sess_close reason);
 
 /* cache_req_body.c */
diff --git a/bin/varnishd/cache/cache_req.c b/bin/varnishd/cache/cache_req.c
index d0b4c3a..1899bb0 100644
--- a/bin/varnishd/cache/cache_req.c
+++ b/bin/varnishd/cache/cache_req.c
@@ -143,7 +143,7 @@ Req_Release(struct req *req)
 /*----------------------------------------------------------------------
  */
 
-int
+void
 Req_Cleanup(struct sess *sp, struct worker *wrk, struct req *req)
 {
 
@@ -189,20 +189,8 @@ Req_Cleanup(struct sess *sp, struct worker *wrk, struct req *req)
 	req->hash_ignore_busy = 0;
 	req->is_hit = 0;
 
-	if (sp->fd >= 0 && req->doclose != SC_NULL)
-		SES_Close(sp, req->doclose);
-
-	if (sp->fd < 0) {
-		wrk->stats->sess_closed++;
-		AZ(req->vcl);
-		Req_Release(req);
-		SES_Delete(sp, SC_NULL, NAN);
-		return (1);
-	}
-
 	WS_Reset(req->ws, 0);
 	WS_Reset(wrk->aws, 0);
-	return (0);
 }
 
 /*----------------------------------------------------------------------
diff --git a/bin/varnishd/http1/cache_http1_fsm.c b/bin/varnishd/http1/cache_http1_fsm.c
index 7ebee6b..3a8b08f 100644
--- a/bin/varnishd/http1/cache_http1_fsm.c
+++ b/bin/varnishd/http1/cache_http1_fsm.c
@@ -327,6 +327,28 @@ http1_dissect(struct worker *wrk, struct req *req)
 /*----------------------------------------------------------------------
  */
 
+static int
+http1_req_cleanup(struct sess *sp, struct worker *wrk, struct req *req)
+{
+	Req_Cleanup(sp, wrk, req);
+
+	if (sp->fd >= 0 && req->doclose != SC_NULL)
+		SES_Close(sp, req->doclose);
+
+	if (sp->fd < 0) {
+		wrk->stats->sess_closed++;
+		AZ(req->vcl);
+		Req_Release(req);
+		SES_Delete(sp, SC_NULL, NAN);
+		return (1);
+	}
+
+	return (0);
+}
+
+/*----------------------------------------------------------------------
+ */
+
 static void
 HTTP1_Session(struct worker *wrk, struct req *req)
 {
@@ -351,7 +373,7 @@ HTTP1_Session(struct worker *wrk, struct req *req)
 			SES_Close(sp, SC_REM_CLOSE);
 		else
 			SES_Close(sp, SC_TX_ERROR);
-		AN(Req_Cleanup(sp, wrk, req));
+		AN(http1_req_cleanup(sp, wrk, req));
 		return;
 	}
 
@@ -451,7 +473,7 @@ HTTP1_Session(struct worker *wrk, struct req *req)
 				    &req->hash_objhead);
 				AZ(req->hash_objhead);
 				SES_Close(sp, SC_REM_CLOSE);
-				AN(Req_Cleanup(sp, wrk, req));
+				AN(http1_req_cleanup(sp, wrk, req));
 				return;
 			}
 			http1_setstate(sp, H1PROC);
@@ -464,7 +486,7 @@ HTTP1_Session(struct worker *wrk, struct req *req)
 			req->task.priv = NULL;
 			http1_setstate(sp, H1CLEANUP);
 		} else if (st == H1CLEANUP) {
-			if (Req_Cleanup(sp, wrk, req))
+			if (http1_req_cleanup(sp, wrk, req))
 				return;
 			HTC_RxInit(req->htc, req->ws);
 			if (req->htc->rxbuf_e != req->htc->rxbuf_b)
diff --git a/bin/varnishd/http2/cache_http2_proto.c b/bin/varnishd/http2/cache_http2_proto.c
index cbb3c52..3ab643e 100644
--- a/bin/varnishd/http2/cache_http2_proto.c
+++ b/bin/varnishd/http2/cache_http2_proto.c
@@ -453,6 +453,8 @@ h2_end_headers(const struct worker *wrk, const struct h2_sess *h2,
 {
 	h2_error h2e;
 
+	assert(r2->state == H2_S_OPEN);
+	r2->state = H2_S_CLOS_REM;
 	h2e = h2h_decode_fini(h2, r2->decode);
 	FREE_OBJ(r2->decode);
 	if (h2e != NULL) {