From 8bb523ab20e06f686a07c5f82e8f8534d4228b9f Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Tue, 1 Jul 2025 20:34:25 +0200 Subject: [PATCH] ubusd: fix txq_len accounting Track the header size in order to avoid underflow Signed-off-by: Felix Fietkau --- ubusd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ubusd.c b/ubusd.c index 1d76b72..5aebce5 100644 --- a/ubusd.c +++ b/ubusd.c @@ -144,7 +144,7 @@ static void ubus_msg_enqueue(struct ubus_client *cl, struct ubus_msg_buf *ub) { struct ubus_msg_buf_list *ubl; - if (cl->txq_len + ub->len > UBUS_CLIENT_MAX_TXQ_LEN) + if (cl->txq_len + sizeof(ub->hdr) + ub->len > UBUS_CLIENT_MAX_TXQ_LEN) return; ubl = calloc(1, sizeof(struct ubus_msg_buf_list)); @@ -155,7 +155,7 @@ static void ubus_msg_enqueue(struct ubus_client *cl, struct ubus_msg_buf *ub) ubl->msg = ubus_msg_ref(ub); list_add_tail(&ubl->list, &cl->tx_queue); - cl->txq_len += ub->len; + cl->txq_len += ub->len + sizeof(ub->hdr); } /* takes the msgbuf reference */ -- 2.30.2