[Dnsmasq-discuss] Infinite loop in PXE proxy replies with a tagged proxy dhcp-range

[Alkis Georgopoulos]

Hi Simon,

I confirm the issue and that Guilherme's patch resolves it.
Please consider applying it upstream.
Debian Trixie and Ubuntu 22.04+ are affected, so that's a lot of users.

Thanks,
Alkis Georgopoulos
LTSP Developer


On 9/8/26 23:54, guilherme.moreira at canonical.com (Guilherme Puida 
Moreira) wrote:

Hello,

We got this bug report [1] in Ubuntu after releasing dnsmasq 2.91 for
Ubuntu 24.04. dnsmasq spins at 100% CPU and stops answering when
handling a seconds PXE-proxy request. This only happens (AFAICT) when
the dhcp-range configuration contains a "set:" tag. Minimal-ish
configuration

port=0
log-dhcp
enable-tftp
tftp-root=/srv/tftp
interface=eth0
dhcp-range=set:proxy,10.10.10.0,proxy,255.255.255.0
pxe-service=x86PC,"ltsp.ipxe",ltsp/ltsp.ipxe

I bisected this to 7199531, and this issue still reproduces on the
current master (a9880c5)

I'm not too familiar with the dnsmasq codebase, but the underlying issue
seems to be an infinite loop when walking through tmp->netid (inside
option_filter). The only other caller of option_filter in this file
(do_options) sets tmp->netid.next to NULL before iterating, so I guess
this should be done here as well. I've attached a diff that fixes the
problem, but I'm not sure if this is the correct approach.

I think the same problem was already reported in this mailing list back
in October [2].

[1]: https://bugs.launchpad.net/ubuntu/+source/dnsmasq/+bug/2166430
[2]:
https://www.mail-archive.com/dnsmasq-discuss at lists.thekelleys.org.uk/msg18159.html

Cheers,
--
Guilherme Puida Moreira