From 3eec7e814841425e71e47642bc603097aac7e102 Mon Sep 17 00:00:00 2001
From: Nils Goroll <nils.goroll@uplex.de>
Date: Thu, 15 Aug 2024 23:26:00 +0200
Subject: [PATCH] Avoid panic if director is already finalized for invalid
 range after rollback

Fixes #4164
---
 bin/varnishd/cache/cache_fetch.c |  3 ++-
 bin/varnishtest/tests/r04164.vtc | 26 ++++++++++++++++++++++++++
 2 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 bin/varnishtest/tests/r04164.vtc

diff --git a/bin/varnishd/cache/cache_fetch.c b/bin/varnishd/cache/cache_fetch.c
index 647201b7abe..650ad26cfc9 100644
--- a/bin/varnishd/cache/cache_fetch.c
+++ b/bin/varnishd/cache/cache_fetch.c
@@ -499,7 +499,8 @@ vbf_stp_startfetch(struct worker *wrk, struct busyobj *bo)
 		bo->htc->doclose = SC_RESP_CLOSE;
 
 	if (VRG_CheckBo(bo) < 0) {
-		VDI_Finish(bo);
+		if (bo->director_state != DIR_S_NULL)
+			VDI_Finish(bo);
 		return (F_STP_ERROR);
 	}
 
diff --git a/bin/varnishtest/tests/r04164.vtc b/bin/varnishtest/tests/r04164.vtc
new file mode 100644
index 00000000000..3c3f400d5ab
--- /dev/null
+++ b/bin/varnishtest/tests/r04164.vtc
@@ -0,0 +1,26 @@
+varnishtest "pass, rollback, invalid range"
+
+server s1 {
+	rxreq
+	expect req.url == "/baz"
+	txresp -status 400
+} -start
+
+varnish v1 -vcl+backend {
+	import std;
+
+	sub vcl_recv {
+		return (pass);
+	}
+	sub vcl_backend_response {
+		std.rollback(bereq);
+		return (retry);
+	}
+} -start
+
+client c1 {
+	txreq -url "/baz" -hdr "range: 42"
+	rxresp
+} -run
+
+server s1 -wait