[PATCH 0/2] Resource leaks and Asus routers
Ed Rose | Tewke <[email protected]> Thu, 12 Mar 2026 15:14:52 +0000
| Newsgroups | dev.linux.lists.connman |
|---|---|
| Message-ID | <[email protected]> |
Hi all,=0A= =0A= This is my first time submitting a patch to a mailing list so I apologise i= f I've made mistakes with formatting.=0A= =0A= This short patch series fixes a couple of bugs that we've discovered in Con= nman that are triggered by a weird hack some mainstream routers have implem= ented. I'll attach a link to an article below on the topic, but the TL;DR i= s that Asus routers intentionally try to crash a buggy windows service that= handles Proxy Auto-configuration by adding DHCP option 252 with the conten= ts '\n' (apparently for performance reasons). Connman unfortunately tries t= o use this value and gets itself into a loop of failing online checks, brea= king online detection and triggering the second bug.=0A= =0A= The second bug is a memory and file descriptor leak that occurs due to the = `wispr_portal_context` not being unreffed under some conditions, notably wh= en it fails to resolve a proxy.=0A= =0A= The result of both of these together is that connman eventually exhausts it= s fd limit and is unable to function.=0A= =0A= Here is a link to a blog post explaining the strange DHCP behaviour:=0A= https://nuxx.net/blog/2022/12/23/how-asus-and-a-microsoft-bug-almost-broke-= remote-work/=0A= =0A= This bug is super easy to replicate if you have a router that allows config= uring DHCP. Ensure connman is configured to perform online checks and set o= ption 252 with a payload of '\n' (0x0a). Watch the file descriptor list in = `/proc/<pid>/fd` grow.=0A= =0A= Ed Rose (2):=0A= wispr: Ensure memory cleaned up in all cases=0A= dhcp: Ignore empty DHCP Option 252=0A= =0A= src/dhcp.c | 7 +++++--=0A= src/wispr.c | 3 ++-=0A= 2 files changed, 7 insertions(+), 3 deletions(-)=0A= =0A= --=0A= 2.43.0=0A= =0A=