Always release the WS when SES_RxStuff() returns.

bin/varnishd/cache/cache_session.c

@@ -284,8 +284,10 @@ SES_RxStuff(struct http_conn *htc, htc_complete_f *func,
 			htc->rxbuf_e += i;
 			*htc->rxbuf_e = '\0';
 		} else if (i == -2) {
-			if (hs == HTC_S_EMPTY && ti < now)
+			if (hs == HTC_S_EMPTY && ti < now) {
+				WS_ReleaseP(htc->ws, htc->rxbuf_b);
 				return (HTC_S_IDLE);
+			}
 		}
 	}
 }

bin/varnishd/http1/cache_http1_fsm.c

@@ -204,6 +204,7 @@ HTTP1_Session(struct worker *wrk, struct req *req)
 			    &req->t_first, &req->t_req,
 			    sp->t_idle + cache_param->timeout_linger,
 			    sp->t_idle + cache_param->timeout_idle);
+			XXXAZ(req->htc->ws->r);
 			if (hs < HTC_S_EMPTY) {
 				req->acct.req_hdrbytes +=
 				    req->htc->rxbuf_e - req->htc->rxbuf_b;

bin/varnishd/proxy/cache_proxy_proto.c

@@ -353,6 +353,7 @@ VPX_Proto_Sess(struct worker *wrk, void *priv)
 
 	hs = SES_RxStuff(req->htc, vpx_complete,
 	    NULL, NULL, NAN, sp->t_idle + cache_param->timeout_idle);
+	XXXAZ(req->htc->ws->r);
 	if (hs != HTC_S_COMPLETE) {
 		Req_Release(req);
 		SES_Delete(sp, SC_RX_JUNK, NAN);