Skip to content

fix(http1): flush the response before handing the connection to an upgrade - #4233

Open
FalkWoldmann wants to merge 1 commit into
hyperium:masterfrom
FalkWoldmann:fix/h1-upgrade-flush
Open

FalkWoldmann wants to merge 1 commit into
hyperium:masterfrom
FalkWoldmann:fix/h1-upgrade-flush

Conversation

@FalkWoldmann

@FalkWoldmann FalkWoldmann commented Oct 14, 2026 •

Copy link
Copy Markdown

Hi, nothing urgent, this only shows up in an edge case, but the fix is small :)

The dispatcher hands the IO off to an upgrade (same for without_shutdown()) before the write buffer is flushed, and into_inner just drops that buffer. Normally that's fine, since for a 101 it's the flush finishing that closes the read side. But when something else closes it first, like poll_drain_or_close_read when the service dropped a request body that hadn't arrived yet, the peer gets a cut-off 101 with the upgraded bytes right behind it. The flush before the hand-off is the same thing poll_shutdown already does. On master the new test gets HTTP/1.1foo=bar

@FalkWoldmann
FalkWoldmann force-pushed the fix/h1-upgrade-flush branch 7 times, most recently from 0ae6271 to 489ebee Compare October 14, 2026 20:33
…grade

The hand-off drops the write buffer, so a 101 can get cut off when the
read side closes before the flush is done, for example when the service
dropped a request body that had not arrived yet.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant