diff mbox series

[19.07,ubus,2/3] libubus: process pending messages in data handler if stack depth is 0

Message ID 20220216104338.15704-3-ynezz@true.cz
State Accepted
Delegated to: Petr Štetiar
Headers show
Series backport fixes for UAF and other issues | expand

Commit Message

Petr Štetiar Feb. 16, 2022, 10:43 a.m. UTC 
From: Felix Fietkau <nbd@nbd.name>

Process pending messages before attempting to read new ones. After completing
the poll, process any remaining pending messages.

A previous message processing call which issued a request from within
its handler may have left behind more object messages to process.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit ef038488edc35f4f671c09276cc3fb4ef706ae34)
---
 libubus-io.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/libubus-io.c b/libubus-io.c
index 3561ac462eb9..a1fb62b1162f 100644
--- a/libubus-io.c
+++ b/libubus-io.c
@@ -314,12 +314,20 @@  void __hidden ubus_handle_data(struct uloop_fd *u, unsigned int events)
 	struct ubus_context *ctx = container_of(u, struct ubus_context, sock);
 	int recv_fd = -1;
 
-	while (get_next_msg(ctx, &recv_fd)) {
+	while (1) {
+		if (!ctx->stack_depth)
+			ctx->pending_timer.cb(&ctx->pending_timer);
+
+		if (!get_next_msg(ctx, &recv_fd))
+			break;
 		ubus_process_msg(ctx, &ctx->msgbuf, recv_fd);
 		if (uloop_cancelling() || ctx->cancel_poll)
 			break;
 	}
 
+	if (!ctx->stack_depth)
+		ctx->pending_timer.cb(&ctx->pending_timer);
+
 	if (u->eof)
 		ctx->connection_lost(ctx);
 }