diff options
| author | Tim Nordell | 2025-10-15 20:43:59 +0000 |
|---|---|---|
| committer | Daniel Golle | 2026-02-09 11:31:44 +0000 |
| commit | 52c64d24ce9cf255b9c348e5db118a35c9407d75 (patch) | |
| tree | f0ae4f9f732f9510d2d83da906e5590ed73b99cd | |
| parent | 96c827fe5f04c8871c086e9d8205bc32371add9e (diff) | |
service instance: Fix overwriting of watchdog linked list members
The instance_config_move(...) function copies the settings from a newly
constructed instance from a "ubus call service set {...}" call into
a prior instance. The `in->watchdog.timeout` is of the type
`struct uloop_timeout` which contains a `struct list` inside of it. This
list is a linked list structure, so when the uloop_timeout is already
in the linked list, this overwrites this particular location with a NULL
pointer for the next/prev entries. This causes procd to crash.
This crash occurs every time "ubus call service set {...}" is called (e.g.
via /etc/init.d/SERVICE start) when a daemon is using the "watchdog"
feature has already been started.
Fixes: 28be011 ("instance: make sure values are not inherited from previous runs")
Signed-off-by: Tim Nordell <tnordell@airgain.com>
| -rw-r--r-- | service/instance.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/service/instance.c b/service/instance.c index b611c0f..fcffd3d 100644 --- a/service/instance.c +++ b/service/instance.c @@ -1519,7 +1519,7 @@ instance_config_move(struct service_instance *in, struct service_instance *in_sr in->term_timeout = in_src->term_timeout; in->watchdog.mode = in_src->watchdog.mode; in->watchdog.freq = in_src->watchdog.freq; - in->watchdog.timeout = in_src->watchdog.timeout; + // Note: in->watchdog.timeout is in a linked list; do not copy in->name = in_src->name; in->nice = in_src->nice; in->trace = in_src->trace; |