diff --git a/package/utils/ucode/patches/010-ubus-fix-refcount-issue-in-uc_ubus_object_notify.patch b/package/utils/ucode/patches/010-ubus-fix-refcount-issue-in-uc_ubus_object_notify.patch new file mode 100644 index 00000000000..92b955ac794 --- /dev/null +++ b/package/utils/ucode/patches/010-ubus-fix-refcount-issue-in-uc_ubus_object_notify.patch @@ -0,0 +1,39 @@ +From: Felix Fietkau +Date: Wed, 18 Jun 2025 17:26:49 +0200 +Subject: [PATCH] ubus: fix refcount issue in uc_ubus_object_notify + +uc_ubus_object_notify_complete_cb will clear the reference in notify_ctx->res, +so in the synchronous case, an extra ucv_get call is needed. +Fixes an accidental double-unref bug + +Fixes: 94ad17d13a0d ("ubus: use ucv_resource_create_ex for ubus.notify resources") +Signed-off-by: Felix Fietkau +--- + +--- a/lib/ubus.c ++++ b/lib/ubus.c +@@ -1290,7 +1290,6 @@ uc_ubus_object_notify(uc_vm_t *vm, size_ + + notifyctx->vm = vm; + notifyctx->ctx = uuobj->ctx; +- notifyctx->res = res; + + blob_buf_init(&buf, 0); + +@@ -1306,6 +1305,7 @@ uc_ubus_object_notify(uc_vm_t *vm, size_ + err_return(rv, "Failed to send notification"); + } + ++ notifyctx->res = ucv_get(res); + notifyctx->req.data_cb = uc_ubus_object_notify_data_cb; + notifyctx->req.status_cb = uc_ubus_object_notify_status_cb; + notifyctx->req.complete_cb = uc_ubus_object_notify_complete_cb; +@@ -1326,7 +1326,7 @@ uc_ubus_object_notify(uc_vm_t *vm, size_ + ucv_resource_persistent_set(res, true); + ubus_complete_request_async(uuobj->ctx, ¬ifyctx->req.req); + +- ok_return(ucv_get(res)); ++ ok_return(res); + } + +