Andrew Geissler | 475cb72 | 2020-07-10 16:00:51 -0500 | [diff] [blame] | 1 | From 85aac526af8612c21b3117dadc8ef5944985b476 Mon Sep 17 00:00:00 2001 |
| 2 | From: Jouni Malinen <jouni@codeaurora.org> |
| 3 | Date: Thu, 4 Jun 2020 21:24:04 +0300 |
| 4 | Subject: [PATCH 3/3] WPS UPnP: Handle HTTP initiation failures for events more |
| 5 | properly |
| 6 | |
| 7 | While it is appropriate to try to retransmit the event to another |
| 8 | callback URL on a failure to initiate the HTTP client connection, there |
| 9 | is no point in trying the exact same operation multiple times in a row. |
| 10 | Replve the event_retry() calls with event_addr_failure() for these cases |
| 11 | to avoid busy loops trying to repeat the same failing operation. |
| 12 | |
| 13 | These potential busy loops would go through eloop callbacks, so the |
| 14 | process is not completely stuck on handling them, but unnecessary CPU |
| 15 | would be used to process the continues retries that will keep failing |
| 16 | for the same reason. |
| 17 | |
| 18 | Upstream-Status: Backport |
| 19 | CVE: CVE-2020-12695 patch #2 |
| 20 | Signed-off-by: Jouni Malinen <jouni@codeaurora.org> |
| 21 | Signed-off-by: Armin Kuster <akuster@mvista.com> |
| 22 | |
| 23 | --- |
| 24 | src/wps/wps_upnp_event.c | 4 ++-- |
| 25 | 1 file changed, 2 insertions(+), 2 deletions(-) |
| 26 | |
| 27 | diff --git a/src/wps/wps_upnp_event.c b/src/wps/wps_upnp_event.c |
| 28 | index 08a23612f338..c0d9e41d9a38 100644 |
| 29 | --- a/src/wps/wps_upnp_event.c |
| 30 | +++ b/src/wps/wps_upnp_event.c |
| 31 | @@ -294,7 +294,7 @@ static int event_send_start(struct subscription *s) |
| 32 | |
| 33 | buf = event_build_message(e); |
| 34 | if (buf == NULL) { |
| 35 | - event_retry(e, 0); |
| 36 | + event_addr_failure(e); |
| 37 | return -1; |
| 38 | } |
| 39 | |
| 40 | @@ -302,7 +302,7 @@ static int event_send_start(struct subscription *s) |
| 41 | event_http_cb, e); |
| 42 | if (e->http_event == NULL) { |
| 43 | wpabuf_free(buf); |
| 44 | - event_retry(e, 0); |
| 45 | + event_addr_failure(e); |
| 46 | return -1; |
| 47 | } |
| 48 | |
| 49 | -- |
| 50 | 2.20.1 |