rpms/cups
7
0
Fork 0
Code Issues Pull Requests Releases Activity

RHEL-154276 endless poll loop in http_write when POLLHUP is returned

Browse Source 
Resolves: RHEL-154276
This commit is contained in:
Zdenek Dohnal 2026-03-10 13:00:32 +01:00
parent 128c42b262
commit 83da7e926c
2 changed files with 52 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
0001-tls-gnutls.c-Do-not-check-for-errno-after-I-O-operat.patch Normal file
View File

@ -0,0 +1,44 @@
From e2419c698922fb65ef62250a4588104021449b55 Mon Sep 17 00:00:00 2001
From: Zdenek Dohnal <zdohnal@redhat.com>
Date: Fri, 6 Mar 2026 08:31:47 +0100
Subject: [PATCH] tls-gnutls.c: Do not check for errno after I/O operations
Based on gnutls_record_send/recv man pages, we should use the return
value of the functions as indicator what happened in the function and do
not look into errno at all.
Checking the errno value caused infinity loop in cupsd on busy servers
if there were enough connection errors when cupsd wrote the response.
The patch is provided by Paul Zirnik from SUSE - thank you for the
patch!
Fixes #827
---
cups/tls-gnutls.c | 4 ++--
diff --git a/cups/tls-gnutls.c b/cups/tls-gnutls.c
index 64f2af372..5769d6313 100644
--- a/cups/tls-gnutls.c
+++ b/cups/tls-gnutls.c
@@ -1208,7 +1208,7 @@ _httpTLSRead(http_t *http, /* I - Connection to server */
result = gnutls_record_recv(http->tls, buf, (size_t)len);
- if (result < 0 && !errno)
+ if (result < 0)
{
/*
* Convert GNU TLS error to errno value...
@@ -1669,7 +1669,7 @@ _httpTLSWrite(http_t *http, /* I - Connection to server */
result = gnutls_record_send(http->tls, buf, (size_t)len);
- if (result < 0 && !errno)
+ if (result < 0)
{
/*
* Convert GNU TLS error to errno value...
--
2.53.0

9
cups.spec
View File

@ -22,7 +22,7 @@ Summary: CUPS printing system
Name: cups
Epoch: 1
Version: 2.4.10
Release: 16%{?dist}
Release: 17%{?dist}
# backend/failover.c - BSD-3-Clause
# cups/md5* - Zlib
# scheduler/colorman.c - Apache-2.0 WITH LLVM-exception AND BSD-2-Clause
@ -127,6 +127,8 @@ Patch1021: 0001-conf.c-Fix-stopping-scheduler-on-unknown-directive.patch
# fix use-after-free reported after fix for CVE-2025-58436
# https://github.com/OpenPrinting/cups/pull/1454
Patch1022: 0001-scheduler-Fix-possible-use_after_free-in-cupsdReadCl.patch
# RHEL-154276 endless poll loop in http_write when POLLHUP is returned
Patch1023: 0001-tls-gnutls.c-Do-not-check-for-errno-after-I-O-operat.patch
##### Patches removed because IMHO they aren't no longer needed
@ -401,6 +403,8 @@ to CUPS daemon. This solution will substitute printer drivers and raw queues in
%patch -P 1021 -p1 -b .ignore-unknown
# fix use-after-free reported after fix for CVE-2025-58436
%patch -P 1022 -p1 -b .osh-use-after-free
# RHEL-154276 endless poll loop in http_write when POLLHUP is returned
%patch -P 1023 -p1 -b .http-endless-poll-loop
# Log to the system journal by default (bug #1078781, bug #1519331).
@ -872,6 +876,9 @@ rm -f %{cups_serverbin}/backend/smb
%{_mandir}/man7/ippeveps.7.gz
%changelog
* Mon Mar 09 2026 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.4.10-17
- RHEL-154276 endless poll loop in http_write when POLLHUP is returned
* Fri Dec 12 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.4.10-16
- fix use-after-free reported by OSH