From ed339a375c1e4c1a30121dfb5469183be07e060e Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Fri, 3 Nov 2017 15:55:24 +0100
Subject: [PATCH] BUG/MAJOR: mux_pt: don't dereference a connstream after
 ->wake()

The wake() callback may destroy a connstream, so it must not be
dereferenced in case wake() returns negative. No backport needed,
this is 1.8-only.
---
 src/mux_pt.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/mux_pt.c b/src/mux_pt.c
index 479f831c6..cd3a28b42 100644
--- a/src/mux_pt.c
+++ b/src/mux_pt.c
@@ -51,8 +51,9 @@ static int mux_pt_wake(struct connection *conn)
 
 	ret = cs->data_cb->wake ? cs->data_cb->wake(cs) : 0;
 
-	cs_update_mux_polling(cs);
-	return (ret);
+	if (ret >= 0)
+		cs_update_mux_polling(cs);
+	return ret;
 }
 
 /* callback used to update the mux's polling flags after changing a cs' status.