proxy_pass race fix

[Eric Wong <normalperson@yhbt.net>]

diff --git a/lib/yahns/proxy_http_response.rb b/lib/yahns/proxy_http_response.rb
index af8d8cc..9db4e71 100644
--- a/lib/yahns/proxy_http_response.rb
+++ b/lib/yahns/proxy_http_response.rb
@@ -227,11 +227,28 @@ def proxy_response_finish(kcar, wbuf, req_res)
     proxy_busy_mod_done(wbuf.wbuf_persist) # returns nil
   end
 
+  def proxy_wait_next(qflags)
+    # We must allocate a new, empty request object here to avoid a TOCTTOU
+    #
+    # original thread:                                 | another thread
+    #                                                  |
+    # r = k.app.call(env = @hs.env)                    | # socket hijacked
+    #                                                  | proxy dispatch ...
+    #                                                  | proxy_busy_mod_done
+    #                                                  | HttpClient#yahns_step
+    # return :ignore if env.include?('rack.hijack_io') |
+    #
+    # In other words, we cannot touch the original env seen by the first thread
+    new_hs = Unicorn::HttpRequest.new
+    new_hs.buf.replace(@hs.buf)
+    @hs = new_hs
+    Thread.current[:yahns_queue].queue_mod(self, qflags)
+  end
+
   def proxy_busy_mod_done(alive)
-    q = Thread.current[:yahns_queue]
     case http_response_done(alive)
-    when :wait_readable then q.queue_mod(self, Yahns::Queue::QEV_RD)
-    when :wait_writable then q.queue_mod(self, Yahns::Queue::QEV_WR)
+    when :wait_readable then proxy_wait_next(Yahns::Queue::QEV_RD)
+    when :wait_writable then proxy_wait_next(Yahns::Queue::QEV_WR)
     when :close then Thread.current[:yahns_fdmap].sync_close(self)
     end