wireless: fix use-after-free bug

[project/netifd.git] / interface-event.c

diff --git a/interface-event.c b/interface-event.c
index 8a92ee7..3b0d1fa 100644 (file)
--- a/interface-event.c
+++ b/interface-event.c
@@ -1,7 +1,19 @@
+/*
+ * netifd - network interface daemon
+ * Copyright (C) 2012 Felix Fietkau <nbd@openwrt.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <unistd.h>
 
 #include <libubox/uloop.h>
 
@@ -20,7 +32,7 @@ static struct uloop_process task = {
 };
 
 static void
-run_cmd(const char *ifname, const char *device, bool up)
+run_cmd(const char *ifname, const char *device, enum interface_event event)
 {
        char *argv[3];
        int pid;
@@ -35,7 +47,8 @@ run_cmd(const char *ifname, const char *device, bool up)
                return;
        }
 
-       setenv("ACTION", up ? "ifup" : "ifdown", 1);
+       char *eventnames[] = {"ifdown", "ifup", "ifupdate"};
+       setenv("ACTION", eventnames[event], 1);
        setenv("INTERFACE", ifname, 1);
        if (device)
                setenv("DEVICE", device, 1);
@@ -61,7 +74,7 @@ call_hotplug(void)
                device = current->l3_dev.dev->ifname;
 
        D(SYSTEM, "Call hotplug handler for interface '%s' (%s)\n", current->name, device ? device : "none");
-       run_cmd(current->name, device, current_ev == IFEV_UP);
+       run_cmd(current->name, device, current_ev);
 }
 
 static void
@@ -86,16 +99,20 @@ interface_queue_event(struct interface *iface, enum interface_event ev)
        enum interface_event last_ev;
 
        D(SYSTEM, "Queue hotplug handler for interface '%s'\n", iface->name);
-       netifd_ubus_interface_event(iface, ev == IFEV_UP);
+       if (ev == IFEV_UP || ev == IFEV_DOWN)
+               netifd_ubus_interface_event(iface, ev == IFEV_UP);
+
+       netifd_ubus_interface_notify(iface, ev != IFEV_DOWN);
+
        if (current == iface)
                last_ev = current_ev;
        else
                last_ev = iface->hotplug_ev;
 
        iface->hotplug_ev = ev;
-       if (last_ev == ev && !list_empty(&iface->hotplug_list))
-               list_del(&iface->hotplug_list);
-       else if (last_ev != ev && list_empty(&iface->hotplug_list))
+       if ((last_ev == ev && ev != IFEV_UPDATE) && !list_empty(&iface->hotplug_list))
+               list_del_init(&iface->hotplug_list);
+       else if ((last_ev != ev || ev == IFEV_UPDATE) && list_empty(&iface->hotplug_list))
                list_add(&iface->hotplug_list, &pending);
 
        if (!task.pending && !current)
@@ -117,6 +134,7 @@ static void interface_event_cb(struct interface_user *dep, struct interface *ifa
 {
        switch (ev) {
                case IFEV_UP:
+               case IFEV_UPDATE:
                case IFEV_DOWN:
                        interface_queue_event(iface, ev);
                        break;