libubox, branch master

blobmsg: use flexible-array member in blobmsg_name()

2026-07-21T08:47:52Z

blobmsg_name() returned (const char *)(hdr + 1), i.e. a pointer to the byte immediately after struct blobmsg_hdr. GCC's stringop analysis treats that region as size 0, so any caller that passes the result to strcmp()/strlen()/etc. under -Wall -Wstringop-overread triggers a false-positive diagnostic. For example, building uhttpd (which uses -Wall -Werror) on aarch64 glibc with GCC 12.3.0 fails with: client.c:302:22: error: 'strcmp' reading 1 or more bytes from a region of size 0 [-Werror=stringop-overread] 302 | if (!strcmp(blobmsg_name(cur), "URL")) Return hdr->name instead. The flexible array member has unknown size in GCC's object-size model, so no warning is emitted. The generated pointer is identical. Signed-off-by: Michael Pfeifroth

ustream: allow freeing the stream from within notify callbacks

2026-07-08T16:38:02Z

Freeing a ustream from notify_read or notify_write left the core and the fd implementation operating on freed memory: ustream_fill_read() clears the pending callback flag after notify_read, the fd read loop keeps filling the stream, ustream_write_pending() evaluates the EOF state after notify_write and the poll handler continues with write and error processing afterwards. Let ustream_free() signal the innermost active dispatch guard through a flag pointer stored in the stream. A triggered guard forwards the signal to the next outer one, so nested dispatch sites all bail out without touching the freed stream. notify_state is invoked as a tail call and needs no guard. Signed-off-by: Felix Fietkau

vlist: pass the tree as comparator context in VLIST_TREE_INIT

2026-07-08T08:47:08Z

vlist_init() initialises the underlying AVL tree with the vlist_tree as the comparator context pointer, but the static VLIST_TREE_INIT() macro passed NULL. A comparator that relies on the vlist convention of receiving the tree as its third argument therefore worked for trees set up with vlist_init() but received NULL for trees defined statically with VLIST_TREE()/VLIST_TREE_INIT(), causing a crash or miscompare. Pass the tree so both initialisation paths behave identically. Signed-off-by: Felix Fietkau

uloop: fix use-after-free in uloop_handle_processes when a callback deletes a process

2026-07-08T08:36:58Z

uloop_handle_processes() walked the process list with list_for_each_entry_safe(), whose cached next entry became dangling if a process callback deleted and freed another process watcher (duplicate pids are allowed, so a sibling with the same pid could be freed mid-dispatch). Track the next entry in a module-level pointer advanced by uloop_process_delete(), matching the signal_consume() fix, so the loop tolerates arbitrary deletions. Signed-off-by: Felix Fietkau

uloop: fix use-after-free in signal_consume when a callback deletes a watcher

2026-07-08T08:34:44Z

signal_consume() dispatched signal callbacks with list_for_each_entry_safe(), which caches the next entry. A callback that deleted and freed a different signal watcher (its own successor in the list) left the iterator pointing at freed memory, dereferenced on the next iteration. Track the next entry to be visited in a module-level pointer and advance it from uloop_signal_delete() when that entry is removed, so the loop stays valid across arbitrary deletions, mirroring the cur_fds[] fixup used for fd dispatch. Signed-off-by: Felix Fietkau

uloop: fix kqueue timer interval arithmetic

2026-07-08T08:34:23Z

The kqueue timer computed msecs * 1000 in unsigned int, which overflows for intervals above roughly 71 minutes and armed a far shorter timer than requested. timer_next() used the same overflowing expression and, for a zero interval, spun forever in 'while (t1 < t2) t1 += 0', hanging the process on the first uloop_interval_remaining() call. Compute the interval in int64_t and return 0 remaining for a non-positive step. Signed-off-by: Felix Fietkau

uloop: fix kevent() eventlist size argument in register_kevent

2026-07-08T08:32:57Z

register_kevent() passed a flags value (0 or EV_DELETE) as the nevents argument of kevent() while giving a NULL eventlist. On deletion this asked the kernel to copy out up to EV_DELETE (2) events into a NULL buffer, which fails with EFAULT when events are pending, so uloop_fd_delete() spuriously returned -1 and pending events could be consumed and lost. Per-filter EV_DELETE is already set via get_flags(), so pass 0 as the eventlist size. Signed-off-by: Felix Fietkau

utils: guard cbuf_order against zero and one

2026-07-08T08:32:36Z

cbuf_order() computed 32 - __builtin_clz(x - 1). For x == 1 the argument to __builtin_clz() is 0, whose result is undefined, and for x == 0 it returned a nonsensical order of 32. Both feed cbuf_size()/cbuf_alloc(). Return order 0 for x <= 1, which cbuf_size() then clamps to the page size as before. Signed-off-by: Felix Fietkau

ustream: reset byte and buffer counters when freeing buffers

2026-07-08T08:32:03Z

ustream_free_buffers() cleared the buffer list pointers but left data_bytes and buffers at their old non-zero values. When a write error tears down the write buffer list (ustream_state_change_cb()), the stale w.data_bytes then made ustream_pending_data() and direct data_bytes checks report buffered data forever. Since writes are disabled after a write error, the count could never drain, so callers that wait for pending write data to reach zero before closing stalled indefinitely. Reset the counters along with the pointers. Signed-off-by: Felix Fietkau

usock: retry poll() on EINTR in usock_wait_ready()

2026-07-08T08:30:08Z

usock_wait_ready() reported a signal interruption of poll() as a hard failure: poll() is not restarted by SA_RESTART, so any signal arriving while waiting for a non-blocking connect (e.g. SIGCHLD in a daemon) made the function return a positive errno and the caller abandon a still- viable connection, also losing the remaining timeout. Route the wait through poll_restart(), which retries with the remaining timeout, and make poll_restart() treat a negative timeout as an infinite wait so the blocking case keeps working. Signed-off-by: Felix Fietkau