diff mbox series

[19.07,ubus,1/3] libubus: use list_empty/list_first_entry in ubus_process_pending_msg

Message ID 20220216104338.15704-2-ynezz@true.cz
State Accepted
Delegated to: Petr Štetiar
Headers show
Series backport fixes for UAF and other issues | expand

Commit Message

Petr Štetiar Feb. 16, 2022, 10:43 a.m. UTC 
From: Felix Fietkau <nbd@nbd.name>

Simplifies checks and avoids potential list corruption on recursive calls

Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 2099bb3ad9972c6188c38fd885ae74f3323fcacc)
---
 libubus.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/libubus.c b/libubus.c
index 91f317c59867..7ce454eabc64 100644
--- a/libubus.c
+++ b/libubus.c
@@ -115,12 +115,13 @@  ubus_process_msg(struct ubus_context *ctx, struct ubus_msghdr_buf *buf, int fd)
 static void ubus_process_pending_msg(struct uloop_timeout *timeout)
 {
 	struct ubus_context *ctx = container_of(timeout, struct ubus_context, pending_timer);
-	struct ubus_pending_msg *pending, *tmp;
+	struct ubus_pending_msg *pending;
 
-	list_for_each_entry_safe(pending, tmp, &ctx->pending, list) {
+	while (!list_empty(&ctx->pending)) {
 		if (ctx->stack_depth)
 			break;
 
+		pending = list_first_entry(&ctx->pending, struct ubus_pending_msg, list);
 		list_del(&pending->list);
 		ubus_process_msg(ctx, &pending->hdr, -1);
 		free(pending);