wireless: fix use-after-free bug
[project/netifd.git] / bridge.c
index a970d50..4ef0d7e 100644 (file)
--- a/bridge.c
+++ b/bridge.c
@@ -31,6 +31,7 @@ enum {
        BRIDGE_ATTR_AGEING_TIME,
        BRIDGE_ATTR_HELLO_TIME,
        BRIDGE_ATTR_MAX_AGE,
+       BRIDGE_ATTR_BRIDGE_EMPTY,
        __BRIDGE_ATTR_MAX
 };
 
@@ -43,13 +44,14 @@ static const struct blobmsg_policy bridge_attrs[__BRIDGE_ATTR_MAX] = {
        [BRIDGE_ATTR_HELLO_TIME] = { "hello_time", BLOBMSG_TYPE_INT32 },
        [BRIDGE_ATTR_MAX_AGE] = { "max_age", BLOBMSG_TYPE_INT32 },
        [BRIDGE_ATTR_IGMP_SNOOP] = { "igmp_snooping", BLOBMSG_TYPE_BOOL },
+       [BRIDGE_ATTR_BRIDGE_EMPTY] = { "bridge_empty", BLOBMSG_TYPE_BOOL },
 };
 
-static const union config_param_info bridge_attr_info[__BRIDGE_ATTR_MAX] = {
+static const struct uci_blob_param_info bridge_attr_info[__BRIDGE_ATTR_MAX] = {
        [BRIDGE_ATTR_IFNAME] = { .type = BLOBMSG_TYPE_STRING },
 };
 
-static const struct config_param_list bridge_attr_list = {
+static const struct uci_blob_param_list bridge_attr_list = {
        .n_params = __BRIDGE_ATTR_MAX,
        .params = bridge_attrs,
        .info = bridge_attr_info,
@@ -176,7 +178,7 @@ bridge_remove_member(struct bridge_member *bm)
        if (!bm->present)
                return;
 
-       if (bm == bst->primary_port);
+       if (bm == bst->primary_port)
                bridge_reset_primary(bst);
 
        if (bst->dev.active)
@@ -185,6 +187,9 @@ bridge_remove_member(struct bridge_member *bm)
        bm->present = false;
        bm->bst->n_present--;
 
+       if (bst->config.bridge_empty)
+               return;
+
        bst->force_active = false;
        if (bst->n_present == 0)
                device_set_present(&bst->dev, false);
@@ -313,6 +318,9 @@ bridge_create_member(struct bridge_state *bst, struct device *dev, bool hotplug)
        struct bridge_member *bm;
 
        bm = calloc(1, sizeof(*bm) + strlen(dev->ifname) + 1);
+       if (!bm)
+               return NULL;
+
        bm->bst = bst;
        bm->dev.cb = bridge_member_cb;
        bm->dev.hotplug = hotplug;
@@ -444,12 +452,16 @@ bridge_config_init(struct device *dev)
 
        bst = container_of(dev, struct bridge_state, dev);
 
-       if (!bst->ifnames)
-               return;
+       if (bst->config.bridge_empty) {
+               bst->force_active = true;
+               device_set_present(&bst->dev, true);
+       }
 
        vlist_update(&bst->members);
-       blobmsg_for_each_attr(cur, bst->ifnames, rem) {
-               bridge_add_member(bst, blobmsg_data(cur));
+       if (bst->ifnames) {
+               blobmsg_for_each_attr(cur, bst->ifnames, rem) {
+                       bridge_add_member(bst, blobmsg_data(cur));
+               }
        }
        vlist_flush(&bst->members);
 }
@@ -463,7 +475,8 @@ bridge_apply_settings(struct bridge_state *bst, struct blob_attr **tb)
        /* defaults */
        cfg->stp = false;
        cfg->forward_delay = 2;
-       cfg->igmp_snoop = true;
+       cfg->igmp_snoop = false;
+       cfg->bridge_empty = false;
        cfg->priority = 0x7FFF;
 
        if ((cur = tb[BRIDGE_ATTR_STP]))
@@ -492,6 +505,9 @@ bridge_apply_settings(struct bridge_state *bst, struct blob_attr **tb)
                cfg->max_age = blobmsg_get_u32(cur);
                cfg->flags |= BRIDGE_OPT_MAX_AGE;
        }
+
+       if ((cur = tb[BRIDGE_ATTR_BRIDGE_EMPTY]))
+               cfg->bridge_empty = blobmsg_get_bool(cur);
 }
 
 enum dev_change_type
@@ -525,7 +541,7 @@ bridge_reload(struct device *dev, struct blob_attr *attr)
                        blob_data(bst->config_data), blob_len(bst->config_data));
 
                diff = 0;
-               config_diff(tb_dev, otb_dev, &device_attr_list, &diff);
+               uci_blob_diff(tb_dev, otb_dev, &device_attr_list, &diff);
                if (diff & ~(1 << DEV_ATTR_IFNAME))
                    ret = DEV_CONFIG_RESTART;
 
@@ -533,7 +549,7 @@ bridge_reload(struct device *dev, struct blob_attr *attr)
                        blob_data(bst->config_data), blob_len(bst->config_data));
 
                diff = 0;
-               config_diff(tb_br, otb_br, &bridge_attr_list, &diff);
+               uci_blob_diff(tb_br, otb_br, &bridge_attr_list, &diff);
                if (diff & ~(1 << BRIDGE_ATTR_IFNAME))
                    ret = DEV_CONFIG_RESTART;
 
@@ -569,5 +585,3 @@ bridge_create(const char *name, struct blob_attr *attr)
 
        return dev;
 }
-
-