uhttpd: fix crashes in the ubus plugin

The ubus plugin calls blocking ubus functions that loop back into
uloop_run. Protect the client data structure with refcounting to ensure
that the outer uloop_run call does not clean up the data that the inner
uloop_run call is still processing.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

1 files changed, 8 insertions, 0 deletions

diff --git a/ubus.c b/ubus.c
index cf5f529..da1ab60 100644
--- a/ubus.c
+++ b/ubus.c
@@ -332,6 +332,8 @@ static void uh_ubus_send_list(struct client *cl, json_object *obj, struct blob_a
 
 	blob_buf_init(data.buf, 0);
 
+	uh_client_ref(cl);
+
 	if (!params || blob_id(params) != BLOBMSG_TYPE_ARRAY) {
 		r = blobmsg_open_array(data.buf, "result");
 		ubus_lookup(ctx, NULL, uh_ubus_list_cb, &data);
@@ -351,6 +353,8 @@ static void uh_ubus_send_list(struct client *cl, json_object *obj, struct blob_a
 		blobmsg_close_table(data.buf, r);
 	}
 
+	uh_client_unref(cl);
+
 	uh_ubus_init_response(cl);
 	blobmsg_add_blob(&buf, blob_data(data.buf->head));
 	uh_ubus_send_response(cl);
@@ -463,6 +467,8 @@ static void uh_ubus_handle_request_object(struct client *cl, struct json_object
 	struct rpc_data data = {};
 	enum rpc_error err = ERROR_PARSE;
 
+	uh_client_ref(cl);
+
 	if (json_object_get_type(obj) != json_type_object)
 		goto error;
 
@@ -506,6 +512,8 @@ error:
 out:
 	if (data.params)
 		free(data.params);
+
+	uh_client_unref(cl);
 }
 
 static void __uh_ubus_next_batched_request(struct uloop_timeout *timeout)