Repository navigation
[release/9.0] Fix h3 connection-level and stream-level abort locking - #69151
Merged
Merged
Conversation
BrennanConroy
added
the
area-networking
Contributor
|
Hi @BrennanConroy. If this is not a tell-mode PR, please make sure to follow the instructions laid out in the servicing process document. |
Contributor
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
The change alters HTTP/3 concurrency/locking and stream lifecycle ordering in a release backport, which warrants final human review despite appearing correct.
Review tier: Lite
Findings: None
What changed in this PR
This PR backports the HTTP/3 fix from #68102 to release/9.0 to prevent deadlocks between connection-level and stream-level abort paths by reordering locking and ensuring abort side-effects complete before stream reuse/pooling.
Changes:
- Moves HTTP/3 abort side-effects (notably
_http3Output.Stop()/ frame-writer abort) outside_completionLockto avoid lock-order inversion with the output producer’s writer lock. - Introduces an abort-completion
TaskCompletionSourceand awaits it during request finalization to prevent late abort side-effects from affecting a pooled/reused stream.
| File | Description |
|---|---|
| src/Servers/Kestrel/Core/src/Internal/Http3/Http3Stream.cs | Reworks abort locking and adds abort-completion synchronization before draining/disposing/pooling the underlying transport. |
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
BrennanConroy
changed the title
Contributor
|
Hi @BrennanConroy. This PR was just approved to be included in the upcoming servicing release. Somebody from the @dotnet/aspnet-build team will get it merged when the branches are open. Until then, please make sure all the CI checks pass and the PR is reviewed. |
wtgodbe
approved these changes
Sep 9, 2026
This was referenced Oct 13, 2026
Merged
Closed
github-actions Bot
pushed a commit
to dlresende/extreme-carpaccio
that referenced
this pull request
Nov 1, 2026
) Updated [Microsoft.AspNetCore.Mvc.Testing](https://github.com/dotnet/aspnetcore) from 9.0.20 to 9.0.22. <details> <summary>Release notes</summary> _Sourced from [Microsoft.AspNetCore.Mvc.Testing's releases](https://github.com/dotnet/aspnetcore/releases)._ ## 9.0.21 [Release](https://github.com/dotnet/core/releases/tag/v9.0.21) ## What's Changed * [release/9.0] Update branding to 9.0.21 by @vseanreesermsft in dotnet/aspnetcore#68962 * [release/9.0] Update dependencies from dotnet/source-build-assets by @dotnet-maestro[bot] in dotnet/aspnetcore#68967 * [release/9.0] (deps): Bump src/submodules/googletest from `3940de9` to `36ba75f` by @dependabot[bot] in dotnet/aspnetcore#68919 * [release/9.0] Update OpenApi to 1.6.31 by @Youssef1313 in dotnet/aspnetcore#68837 * [release/9.0] Extract IsAuthenticated helper method by @Youssef1313 with @Copilot in dotnet/aspnetcore#68659 * [release/9.0] Update dependencies from dotnet/arcade by @dotnet-maestro[bot] in dotnet/aspnetcore#68570 * [release/9.0] Update dependencies from dotnet/arcade by @dotnet-maestro[bot] in dotnet/aspnetcore#69085 * [release/9.0] Fix h3 connection-level and stream-level abort locking by @BrennanConroy in dotnet/aspnetcore#69151 * Merging internal commits for release/9.0 by @dotnet-bot in dotnet/aspnetcore#69179 * [release/9.0] [SignalR] [Java] Fix hang when reading an HTTP response body fails by @github-actions[bot] in dotnet/aspnetcore#69208 * [release/9.0] Fix: hardening http2 to refuse newline chars on trailers and dynamic HPACK table by @BrennanConroy in dotnet/aspnetcore#69249 * [release/9.0] Scope sections E2E assertions to mounted app by @wtgodbe in dotnet/aspnetcore#69252 * [release/9.0] Update dependencies from dotnet/arcade by @dotnet-maestro[bot] in dotnet/aspnetcore#69268 * Update MessagePack to 2.5.303 by @BrennanConroy in dotnet/aspnetcore#69369 **Full Changelog**: dotnet/aspnetcore@v9.0.20...v9.0.21 Commits viewable in [compare view](https://github.com/dotnet/aspnetcore/commits). </details> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
github-actions Bot
pushed a commit
to dlresende/extreme-carpaccio
that referenced
this pull request
Nov 1, 2026
) Updated [Microsoft.AspNetCore.Mvc.Testing](https://github.com/dotnet/aspnetcore) from 9.0.20 to 9.0.22. <details> <summary>Release notes</summary> _Sourced from [Microsoft.AspNetCore.Mvc.Testing's releases](https://github.com/dotnet/aspnetcore/releases)._ ## 9.0.21 [Release](https://github.com/dotnet/core/releases/tag/v9.0.21) ## What's Changed * [release/9.0] Update branding to 9.0.21 by @vseanreesermsft in dotnet/aspnetcore#68962 * [release/9.0] Update dependencies from dotnet/source-build-assets by @dotnet-maestro[bot] in dotnet/aspnetcore#68967 * [release/9.0] (deps): Bump src/submodules/googletest from `3940de9` to `36ba75f` by @dependabot[bot] in dotnet/aspnetcore#68919 * [release/9.0] Update OpenApi to 1.6.31 by @Youssef1313 in dotnet/aspnetcore#68837 * [release/9.0] Extract IsAuthenticated helper method by @Youssef1313 with @Copilot in dotnet/aspnetcore#68659 * [release/9.0] Update dependencies from dotnet/arcade by @dotnet-maestro[bot] in dotnet/aspnetcore#68570 * [release/9.0] Update dependencies from dotnet/arcade by @dotnet-maestro[bot] in dotnet/aspnetcore#69085 * [release/9.0] Fix h3 connection-level and stream-level abort locking by @BrennanConroy in dotnet/aspnetcore#69151 * Merging internal commits for release/9.0 by @dotnet-bot in dotnet/aspnetcore#69179 * [release/9.0] [SignalR] [Java] Fix hang when reading an HTTP response body fails by @github-actions[bot] in dotnet/aspnetcore#69208 * [release/9.0] Fix: hardening http2 to refuse newline chars on trailers and dynamic HPACK table by @BrennanConroy in dotnet/aspnetcore#69249 * [release/9.0] Scope sections E2E assertions to mounted app by @wtgodbe in dotnet/aspnetcore#69252 * [release/9.0] Update dependencies from dotnet/arcade by @dotnet-maestro[bot] in dotnet/aspnetcore#69268 * Update MessagePack to 2.5.303 by @BrennanConroy in dotnet/aspnetcore#69369 **Full Changelog**: dotnet/aspnetcore@v9.0.20...v9.0.21 Commits viewable in [compare view](https://github.com/dotnet/aspnetcore/commits). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This was referenced Nov 1, 2026
Open
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #68102 to release/9.0
/cc @BrennanConroy @cincuranet
Fix h3 connection-level and stream-level abort locking
Description
Improve server reliability when using HTTP/3.
Fixes #68101
Customer Impact
Threads can get blocked resulting in more threads being created.
Regression?
Risk
Follows similar pattern already implemented in HTTP/2
Verification
Packaging changes reviewed?