fix use-after-free on device free codepath due to recursion issues, and fix dev-...

[project/netifd.git] / device.c

diff --git a/device.c b/device.c
index 1136380..91cb37a 100644 (file)
--- a/device.c
+++ b/device.c
@@ -41,6 +41,55 @@ const struct config_param_list device_attr_list = {
        .params = dev_attrs,
 };
 
+static int __devlock = 0;
+
+void device_lock(void)
+{
+       __devlock++;
+}
+
+void device_unlock(void)
+{
+       __devlock--;
+       if (!__devlock)
+               device_free_unused(NULL);
+}
+
+static int set_device_state(struct device *dev, bool state)
+{
+       if (state)
+               system_if_up(dev);
+       else
+               system_if_down(dev);
+
+       return 0;
+}
+
+static int
+simple_device_set_state(struct device *dev, bool state)
+{
+       struct device *pdev;
+       int ret = 0;
+
+       pdev = dev->parent.dev;
+       if (state && !pdev) {
+               pdev = system_if_get_parent(dev);
+               if (pdev)
+                       device_add_user(&dev->parent, pdev);
+       }
+
+       if (pdev) {
+               if (state)
+                       ret = device_claim(&dev->parent);
+               else
+                       device_release(&dev->parent);
+
+               if (ret < 0)
+                       return ret;
+       }
+       return set_device_state(dev, state);
+}
+
 static struct device *
 simple_device_create(const char *name, struct blob_attr *attr)
 {
@@ -52,6 +101,7 @@ simple_device_create(const char *name, struct blob_attr *attr)
        if (!dev)
                return NULL;
 
+       dev->set_state = simple_device_set_state;
        device_init_settings(dev, tb);
 
        return dev;
@@ -59,6 +109,8 @@ simple_device_create(const char *name, struct blob_attr *attr)
 
 static void simple_device_free(struct device *dev)
 {
+       if (dev->parent.dev)
+               device_remove_user(&dev->parent);
        device_cleanup(dev);
        free(dev);
 }
@@ -172,6 +224,8 @@ alias_notify_device(const char *name, struct device *dev)
 {
        struct alias_device *alias;
 
+       device_lock();
+
        alias = avl_find_element(&aliases, name, alias, avl);
        if (!alias)
                return;
@@ -189,16 +243,8 @@ alias_notify_device(const char *name, struct device *dev)
 
        if (!dev && alias->dep.dev && !alias->dep.dev->active)
                device_remove_user(&alias->dep);
-}
-
-static int set_device_state(struct device *dev, bool state)
-{
-       if (state)
-               system_if_up(dev);
-       else
-               system_if_down(dev);
 
-       return 0;
+       device_unlock();
 }
 
 int device_claim(struct device_user *dep)
@@ -290,12 +336,14 @@ int device_init(struct device *dev, const struct device_type *type, const char *
 }
 
 static struct device *
-device_create_default(const char *name)
+device_create_default(const char *name, bool external)
 {
        struct device *dev;
 
        D(DEVICE, "Create simple device '%s'\n", name);
        dev = calloc(1, sizeof(*dev));
+       dev->external = external;
+       dev->set_state = simple_device_set_state;
        device_init(dev, &simple_device_type, name);
        dev->default_config = true;
        return dev;
@@ -314,7 +362,7 @@ device_alias_get(const char *name)
 }
 
 struct device *
-device_get(const char *name, bool create)
+device_get(const char *name, int create)
 {
        struct device *dev;
 
@@ -331,7 +379,7 @@ device_get(const char *name, bool create)
        if (!create)
                return NULL;
 
-       return device_create_default(name);
+       return device_create_default(name, create > 1);
 }
 
 static void
@@ -382,10 +430,18 @@ void device_add_user(struct device_user *dep, struct device *dev)
        }
 }
 
+void
+device_free(struct device *dev)
+{
+       __devlock++;
+       dev->type->free(dev);
+       __devlock--;
+}
+
 static void
 __device_free_unused(struct device *dev)
 {
-       if (!list_empty(&dev->users) || dev->current_config || config_init)
+       if (!list_empty(&dev->users) || dev->current_config || __devlock)
                return;
 
        device_free(dev);
@@ -398,6 +454,7 @@ void device_remove_user(struct device_user *dep)
        if (!dep->dev)
                return;
 
+       dep->hotplug = false;
        if (dep->claimed)
                device_release(dep);
 
@@ -508,7 +565,7 @@ device_reset_old(void)
                if (dev->type != &simple_device_type)
                        continue;
 
-               ndev = device_create_default(dev->ifname);
+               ndev = device_create_default(dev->ifname, dev->external);
                device_replace(ndev, dev);
        }
 }