uhttpd: fix crashes in the ubus plugin

The ubus plugin calls blocking ubus functions that loop back into
uloop_run. Protect the client data structure with refcounting to ensure
that the outer uloop_run call does not clean up the data that the inner
uloop_run call is still processing.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

1 files changed, 16 insertions, 0 deletions

diff --git a/uhttpd.h b/uhttpd.h
index b289a24..a620030 100644
--- a/uhttpd.h
+++ b/uhttpd.h
@@ -118,6 +118,7 @@ enum client_state {
 	CLIENT_STATE_DATA,
 	CLIENT_STATE_DONE,
 	CLIENT_STATE_CLOSE,
+	CLIENT_STATE_CLEANUP,
 };
 
 struct interpreter {
@@ -223,6 +224,7 @@ struct dispatch {
 
 struct client {
 	struct list_head list;
+	int refcount;
 	int id;
 
 	struct ustream *us;
@@ -298,4 +300,18 @@ bool uh_create_process(struct client *cl, struct path_info *pi, char *url,
 int uh_plugin_init(const char *name);
 void uh_plugin_post_init(void);
 
+static inline void uh_client_ref(struct client *cl)
+{
+	cl->refcount++;
+}
+
+static inline void uh_client_unref(struct client *cl)
+{
+	if (--cl->refcount)
+		return;
+
+	if (cl->state == CLIENT_STATE_CLEANUP)
+		ustream_state_change(cl->us);
+}
+
 #endif