BUG/MINOR: mux-quic: remove qcs from opening-list on free

qcs instances for bidirectional streams are inserted in
<qcc.opening_list>. It is removed from the list once a full HTTP request
has been parsed. This is required to implement http-request timeout.

If a qcs instance is freed before receiving a full HTTP request, it must
be removed from the <qcc.opening_list>. Else a segfault will occur in
qcc_refresh_timeout() when accessing a dangling pointer.

For the moment this bug was not reproduced in production. This is
because there exists only few rare cases where a qcs is freed before
HTTP request parsing. However, as error detection will be improved on
H3, this will occur more frequently in the near future.

This must be backported up to 2.6.

(cherry picked from commit 641a65ff3c)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 252b67c4722ff2d4131e7875879364087f27a2fa)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>

src/mux_quic.c

@@ -155,6 +155,9 @@ static void qcs_free(struct qcs *qcs)
 
 	TRACE_ENTER(QMUX_EV_QCS_END, qcc->conn, qcs);
 
+	if (LIST_INLIST(&qcs->el_opening))
+		LIST_DELETE(&qcs->el_opening);
+
 	qc_free_ncbuf(qcs, &qcs->rx.ncbuf);
 	b_free(&qcs->tx.buf);