[PATCH 0/2] Resource leaks and Asus routers

Ed Rose | Tewke <[email protected]> Thu, 12 Mar 2026 15:14:52 +0000
Newsgroups dev.linux.lists.connman
Message-ID <[email protected]>
Hi all,=0A=
=0A=
This is my first time submitting a patch to a mailing list so I apologise i=
f I've made mistakes with formatting.=0A=
=0A=
This short patch series fixes a couple of bugs that we've discovered in Con=
nman that are triggered by a weird hack some mainstream routers have implem=
ented. I'll attach a link to an article below on the topic, but the TL;DR i=
s that Asus routers intentionally try to crash a buggy windows service that=
 handles Proxy Auto-configuration by adding DHCP option 252 with the conten=
ts '\n' (apparently for performance reasons). Connman unfortunately tries t=
o use this value and gets itself into a loop of failing online checks, brea=
king online detection and triggering the second bug.=0A=
=0A=
The second bug is a memory and file descriptor leak that occurs due to the =
`wispr_portal_context` not being unreffed under some conditions, notably wh=
en it fails to resolve a proxy.=0A=
=0A=
The result of both of these together is that connman eventually exhausts it=
s fd limit and is unable to function.=0A=
=0A=
Here is a link to a blog post explaining the strange DHCP behaviour:=0A=
https://nuxx.net/blog/2022/12/23/how-asus-and-a-microsoft-bug-almost-broke-=
remote-work/=0A=
=0A=
This bug is super easy to replicate if you have a router that allows config=
uring DHCP. Ensure connman is configured to perform online checks and set o=
ption 252 with a payload of '\n' (0x0a). Watch the file descriptor list in =
`/proc/<pid>/fd` grow.=0A=
=0A=
Ed Rose (2):=0A=
  wispr: Ensure memory cleaned up in all cases=0A=
  dhcp: Ignore empty DHCP Option 252=0A=
=0A=
 src/dhcp.c  | 7 +++++--=0A=
 src/wispr.c | 3 ++-=0A=
 2 files changed, 7 insertions(+), 3 deletions(-)=0A=
=0A=
--=0A=
2.43.0=0A=
=0A=