[Dnsmasq-discuss] Infinite loop in PXE proxy replies with a tagged proxy dhcp-range

[Guilherme Puida Moreira]

Hello,

We got this bug report [1] in Ubuntu after releasing dnsmasq 2.91 for
Ubuntu 24.04. dnsmasq spins at 100% CPU and stops answering when
handling a seconds PXE-proxy request. This only happens (AFAICT) when
the dhcp-range configuration contains a "set:" tag. Minimal-ish
configuration

port=0
log-dhcp
enable-tftp
tftp-root=/srv/tftp
interface=eth0
dhcp-range=set:proxy,10.10.10.0,proxy,255.255.255.0
pxe-service=x86PC,"ltsp.ipxe",ltsp/ltsp.ipxe

I bisected this to 7199531, and this issue still reproduces on the
current master (a9880c5)

I'm not too familiar with the dnsmasq codebase, but the underlying issue
seems to be an infinite loop when walking through tmp->netid (inside
option_filter). The only other caller of option_filter in this file
(do_options) sets tmp->netid.next to NULL before iterating, so I guess
this should be done here as well. I've attached a diff that fixes the
problem, but I'm not sure if this is the correct approach.

I think the same problem was already reported in this mailing list back
in October [2].

[1]: https://bugs.launchpad.net/ubuntu/+source/dnsmasq/+bug/2166430
[2]:
https://www.mail-archive.com/dnsmasq-discuss@lists.thekelleys.org.uk/msg18159.html

Cheers,
-- 
Guilherme Puida Moreira
-------------- next part --------------
A non-text attachment was scrubbed...
Name: set-netid-next-to-null.diff
Type: text/x-patch
Size: 462 bytes
Desc: not available
URL: <http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/attachments/20260908/8787c012/attachment.bin>