diff --git a/ssdpd/patches/012-ubus-runner-thread-hook b/ssdpd/patches/012-ubus-runner-thread-hook
index dc4893b79..263d9e7c4 100644
--- a/ssdpd/patches/012-ubus-runner-thread-hook
+++ b/ssdpd/patches/012-ubus-runner-thread-hook
@@ -84,7 +84,106 @@
  #define UPNP_DISCOVER_TIMEOUT (30 * 1000)
  
  #ifndef MIN
-@@ -282,6 +281,21 @@ static bool is_desc_exist(const char *de
+@@ -93,17 +92,41 @@ static void add_dev_to_dev_list(char *de
+ 	dev->usn = usn;
+ }
+ 
+-void free_all_dev_list(void)
++static void free_all_dev_list(void)
+ {
+ 	struct UPNPDev *dev = NULL;
++	struct UPNPDev *dev_tmp = NULL;
+ 
+-	while (dev_list.next != &dev_list) {
+-		dev = list_entry(dev_list.next, struct UPNPDev, list);
++	list_for_each_entry_safe(dev, dev_tmp, &dev_list, list) {
++		list_del(&dev->list);
+ 		free(dev->descURL);
+ 		free(dev->st);
+ 		free(dev->usn);
+ 		free(dev);
+-		list_del(&dev->list);
++	}
++}
++
++static void add_desc_to_desc_list(const char *desc_path, const char *url)
++{
++	struct desc_list_elt *desc_elt;
++
++	desc_elt = calloc(1, sizeof(struct desc_list_elt));
++	list_add_tail(&desc_elt->list, &desc_list);
++
++	desc_elt->desc_path = strdup(desc_path);
++	desc_elt->url = strdup(url);
++}
++
++static void free_all_desc_list(void)
++{
++	struct desc_list_elt *desc_elt = NULL;
++	struct desc_list_elt *desc_elt_tmp = NULL;
++
++	list_for_each_entry_safe(desc_elt, desc_elt_tmp, &desc_list, list) {
++		list_del(&desc_elt->list);
++		free(desc_elt->desc_path);
++		free(desc_elt->url);
++		free(desc_elt);
+ 	}
+ }
+ 
+@@ -167,8 +190,8 @@ static int receiveDevicesFromMiniSSDPD(i
+ 	ssize_t n;
+ 	unsigned char *p;
+ 	unsigned int bufferindex;
+-	unsigned int i, ndev;
+-	unsigned int urlsize, stsize, usnsize, l;
++	unsigned int i = 0, ndev = 0;
++	unsigned int urlsize = 0, stsize = 0, usnsize = 0, l = 0;
+ 	char *url, *st, *usn;
+ 
+ 	n = read(s, buffer, sizeof(buffer));
+@@ -182,11 +205,12 @@ static int receiveDevicesFromMiniSSDPD(i
+ 		if (n <= 0)
+ 			return -1;
+ 
+-		url = (char *)malloc(urlsize);
++		url = (char *)calloc(urlsize + 1, sizeof(char));
+ 		if (url == NULL)
+ 			return -1;
+ 
+ 		READ_COPY_BUFFER(url, urlsize);
++		url[urlsize] = 0;
+ 		if (n <= 0)
+ 			return -1;
+ 
+@@ -194,11 +218,12 @@ static int receiveDevicesFromMiniSSDPD(i
+ 		if (n <= 0)
+ 			goto free_url_and_return;
+ 
+-		st = (char *)malloc(stsize);
++		st = (char *)calloc(stsize + 1, sizeof(char));
+ 		if (st == NULL)
+ 			goto free_url_and_return;
+ 
+ 		READ_COPY_BUFFER(st, stsize);
++		st[stsize] = 0;
+ 		if (n <= 0)
+ 			goto free_url_and_st_and_return;
+ 
+@@ -206,11 +231,12 @@ static int receiveDevicesFromMiniSSDPD(i
+ 		if (n <= 0)
+ 			goto free_url_and_st_and_return;
+ 
+-		usn = (char *)malloc(usnsize);
++		usn = (char *)calloc(usnsize + 1, sizeof(char));
+ 		if (usn == NULL)
+ 			goto free_url_and_st_and_return;
+ 
+ 		READ_COPY_BUFFER(usn, usnsize);
++		usn[usnsize] = 0;
+ 		if (n <= 0)
+ 			goto free_url_and_st_and_usn_and_return;
+ 
+@@ -282,6 +308,21 @@ static bool is_desc_exist(const char *de
  	return false;
  }
  
@@ -106,25 +205,35 @@
  static void get_desc_name(const char *desc_url, char *str, size_t len)
  {
  	if (!desc_url || !str || len == 0)
-@@ -297,7 +311,7 @@ static void get_desc_name(const char *de
+@@ -297,37 +338,14 @@ static void get_desc_name(const char *de
  	}
  }
  
 -static void add_desc_to_desc_list(const char *desc_path, const char *url, int is_device_desc)
-+static void add_desc_to_desc_list(const char *desc_path, const char *url)
- {
- 	struct desc_list_elt *desc_elt;
- 
-@@ -306,7 +320,6 @@ static void add_desc_to_desc_list(const
- 
- 	desc_elt->desc_path = strdup(desc_path);
- 	desc_elt->url = strdup(url);
+-{
+-	struct desc_list_elt *desc_elt;
+-
+-	desc_elt = calloc(1, sizeof(struct desc_list_elt));
+-	list_add_tail(&desc_elt->list, &desc_list);
+-
+-	desc_elt->desc_path = strdup(desc_path);
+-	desc_elt->url = strdup(url);
 -	desc_elt->is_device_desc = is_device_desc;
- }
- 
- static void free_all_desc_list(void)
-@@ -324,10 +337,12 @@ static void free_all_desc_list(void)
- 
+-}
+-
+-static void free_all_desc_list(void)
+-{
+-	struct desc_list_elt *desc_elt = NULL;
+-
+-	while (desc_list.next != &desc_list) {
+-		desc_elt = list_entry(desc_list.next, struct desc_list_elt, list);
+-		free(desc_elt->desc_path);
+-		free(desc_elt->url);
+-		free(desc_elt);
+-		list_del(&desc_elt->list);
+-	}
+-}
+-
  static void __upnp_discover_devices(void)
  {
 +	struct desc_list_elt *desc_elt = NULL;
@@ -137,7 +246,7 @@
  
  	/*
  	 * Discover devices
-@@ -349,13 +364,26 @@ static void __upnp_discover_devices(void
+@@ -349,13 +367,26 @@ static void __upnp_discover_devices(void
  
  		get_desc_name(dev->descURL, desc_name, sizeof(desc_name));
  		snprintf(file_path, sizeof(file_path), "%s/%s", UPNP_DESC_PATH, desc_name);
@@ -159,14 +268,14 @@
 +		if (is_device_exist(desc_elt->url))
 +			continue;
 +
++		list_del(&desc_elt->list);
 +		free(desc_elt->desc_path);
 +		free(desc_elt->url);
 +		free(desc_elt);
-+		list_del(&desc_elt->list);
  	}
  
  end:
-@@ -371,15 +399,27 @@ static int upnp_discovery_res(struct ubu
+@@ -371,15 +402,27 @@ static int upnp_discovery_res(struct ubu
  	memset(&bb,0,sizeof(struct blob_buf));
  	blob_buf_init(&bb, 0);
  
@@ -197,7 +306,7 @@
  			blobmsg_close_table(&bb, device_obj);
  		}
  	}
-@@ -472,7 +512,7 @@ static void fill_device_instances(struct
+@@ -472,7 +515,7 @@ static void fill_device_instances(struct
  		blobmsg_close_table(bb, device_obj);
  }
  
@@ -206,7 +315,7 @@
  {
  	mxml_node_t *b = service;
  	void *service_obj = NULL;
-@@ -525,6 +565,32 @@ static void fill_service_element(struct
+@@ -525,6 +568,32 @@ static void fill_service_element(struct
  		blobmsg_close_table(bb, service_obj);
  }
  
@@ -239,7 +348,7 @@
  static int upnp_description_res(struct ubus_context *ctx, struct ubus_object *obj __attribute__((unused)),
  		struct ubus_request_data *req, const char *method __attribute__((unused)), struct blob_attr *msg __attribute__((unused)))
  {
-@@ -534,39 +600,25 @@ static int upnp_description_res(struct u
+@@ -534,39 +603,25 @@ static int upnp_description_res(struct u
  	memset(&bb,0,sizeof(struct blob_buf));
  	blob_buf_init(&bb, 0);
  
@@ -288,7 +397,7 @@
  
  	ubus_send_reply(ctx, req, bb.head);
  	blob_buf_free(&bb);
-@@ -624,3 +676,8 @@ end:
+@@ -624,3 +679,9 @@ end:
  	uloop_done();
  	ubus_free(ctx);
  }