1*4882a593SmuzhiyunCVE: CVE-2021-3468 2*4882a593SmuzhiyunUpstream-Status: Submitted [https://github.com/lathiat/avahi/pull/330] 3*4882a593SmuzhiyunSigned-off-by: Ross Burton <ross.burton@arm.com> 4*4882a593Smuzhiyun 5*4882a593SmuzhiyunFrom 447affe29991ee99c6b9732fc5f2c1048a611d3b Mon Sep 17 00:00:00 2001 6*4882a593SmuzhiyunFrom: Riccardo Schirone <sirmy15@gmail.com> 7*4882a593SmuzhiyunDate: Fri, 26 Mar 2021 11:50:24 +0100 8*4882a593SmuzhiyunSubject: [PATCH] Avoid infinite-loop in avahi-daemon by handling HUP event in 9*4882a593Smuzhiyun client_work 10*4882a593Smuzhiyun 11*4882a593SmuzhiyunIf a client fills the input buffer, client_work() disables the 12*4882a593SmuzhiyunAVAHI_WATCH_IN event, thus preventing the function from executing the 13*4882a593Smuzhiyun`read` syscall the next times it is called. However, if the client then 14*4882a593Smuzhiyunterminates the connection, the socket file descriptor receives a HUP 15*4882a593Smuzhiyunevent, which is not handled, thus the kernel keeps marking the HUP event 16*4882a593Smuzhiyunas occurring. While iterating over the file descriptors that triggered 17*4882a593Smuzhiyunan event, the client file descriptor will keep having the HUP event and 18*4882a593Smuzhiyunthe client_work() function is always called with AVAHI_WATCH_HUP but 19*4882a593Smuzhiyunwithout nothing being done, thus entering an infinite loop. 20*4882a593Smuzhiyun 21*4882a593SmuzhiyunSee https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=984938 22*4882a593Smuzhiyun--- 23*4882a593Smuzhiyun avahi-daemon/simple-protocol.c | 5 +++++ 24*4882a593Smuzhiyun 1 file changed, 5 insertions(+) 25*4882a593Smuzhiyun 26*4882a593Smuzhiyundiff --git a/avahi-daemon/simple-protocol.c b/avahi-daemon/simple-protocol.c 27*4882a593Smuzhiyunindex 3e0ebb11..6c0274d6 100644 28*4882a593Smuzhiyun--- a/avahi-daemon/simple-protocol.c 29*4882a593Smuzhiyun+++ b/avahi-daemon/simple-protocol.c 30*4882a593Smuzhiyun@@ -424,6 +424,11 @@ static void client_work(AvahiWatch *watch, AVAHI_GCC_UNUSED int fd, AvahiWatchEv 31*4882a593Smuzhiyun } 32*4882a593Smuzhiyun } 33*4882a593Smuzhiyun 34*4882a593Smuzhiyun+ if (events & AVAHI_WATCH_HUP) { 35*4882a593Smuzhiyun+ client_free(c); 36*4882a593Smuzhiyun+ return; 37*4882a593Smuzhiyun+ } 38*4882a593Smuzhiyun+ 39*4882a593Smuzhiyun c->server->poll_api->watch_update( 40*4882a593Smuzhiyun watch, 41*4882a593Smuzhiyun (c->outbuf_length > 0 ? AVAHI_WATCH_OUT : 0) | 42