Fix the spinlock loop in VBE_Poll

VBE_Poll would not advance to test the next backend on the cooling
list when the backend's n_conn is non-zero. This would create a
spinlock effect, causing delays that could make the master kill the
child because of CLI timeout.

Fixes: #2295

bin/varnishd/cache/cache_backend_cfg.c

@@ -435,15 +435,13 @@ static struct cli_proto backend_cmds[] = {
 void
 VBE_Poll(void)
 {
-	struct backend *be;
+	struct backend *be, *be2;
 	double now = VTIM_real();
 
 	ASSERT_CLI();
 	Lck_Lock(&backends_mtx);
-	while (1) {
-		be = VTAILQ_FIRST(&cool_backends);
-		if (be == NULL)
-			break;
+	VTAILQ_FOREACH_SAFE(be, &cool_backends, list, be2) {
+		CHECK_OBJ_NOTNULL(be, BACKEND_MAGIC);
 		if (be->cooled > now)
 			break;
 		if (be->n_conn > 0)

bin/varnishtest/tests.disabled/r02295.vtc

+varnishtest "Test cooled dynamic backend clean up"
+
+# This test is disabled because it needs a timeout of 80 seconds (-t80 to
+# varnishtest). This is because the cooled backend timeout in varnish core
+# is hard coded to 60 seconds.
+
+server s1 {
+	rxreq
+	delay 70
+	txresp
+} -start
+
+varnish v1 -arg "-p cli_timeout=2 -p first_byte_timeout=80" -vcl {
+	import debug;
+
+	backend dummy { .host = "${bad_backend}"; }
+
+	sub vcl_init {
+		new s1 = debug.dyn("${s1_addr}", "${s1_port}");
+	}
+
+	sub vcl_recv {
+		if (req.url == "/refresh") {
+			s1.refresh("${s1_addr}", "${s1_port}");
+			return (synth(200, "OK"));
+		}
+	}
+
+	sub vcl_backend_fetch {
+		set bereq.backend = s1.backend();
+	}
+} -start
+
+client c1 {
+	timeout 120
+	txreq
+	rxresp
+	expect resp.status == 200
+} -start
+
+delay 1
+
+client c2 {
+	txreq -url /refresh
+	rxresp
+	expect resp.status == 200
+} -run
+
+delay 61
+
+varnish v1 -cliok "ping"
+
+client c1 -wait