fix use-after-free when an interface event is pending while the interface is being...

[project/netifd.git] / proto-shell.c

diff --git a/proto-shell.c b/proto-shell.c
index 8238c0d..aba7298 100644 (file)
--- a/proto-shell.c
+++ b/proto-shell.c
@@ -41,8 +41,6 @@ struct proto_shell_state {
        struct proto_shell_handler *handler;
        struct blob_attr *config;
 
-       struct device_user l3_dev;
-
        struct uloop_timeout teardown_timeout;
 
        struct netifd_process script_task;
@@ -79,9 +77,6 @@ proto_shell_handler(struct interface_proto_state *proto,
                if (state->sm == S_TEARDOWN)
                        return 0;
 
-               if (state->l3_dev.dev)
-                       device_remove_user(&state->l3_dev);
-
                if (state->script_task.uloop.pending) {
                        if (state->sm != S_SETUP_ABORT) {
                                uloop_timeout_set(&state->teardown_timeout, 1000);
@@ -204,8 +199,6 @@ proto_shell_free(struct interface_proto_state *proto)
        struct proto_shell_state *state;
 
        state = container_of(proto, struct proto_shell_state, proto);
-       if (state->l3_dev.dev)
-               device_remove_user(&state->l3_dev);
        netifd_kill_process(&state->script_task);
        netifd_kill_process(&state->proto_task);
        free(state->config);
@@ -229,6 +222,16 @@ proto_shell_parse_route_list(struct interface *iface, struct blob_attr *attr,
        }
 }
 
+static void
+proto_shell_parse_data(struct interface *iface, struct blob_attr *attr)
+{
+       struct blob_attr *cur;
+       int rem;
+
+       blobmsg_for_each_attr(cur, attr, rem)
+               interface_add_data(iface, cur);
+}
+
 static struct device *
 proto_shell_create_tunnel(const char *name, struct blob_attr *attr)
 {
@@ -257,6 +260,7 @@ enum {
        NOTIFY_ROUTES,
        NOTIFY_ROUTES6,
        NOTIFY_TUNNEL,
+       NOTIFY_DATA,
        __NOTIFY_LAST
 };
 
@@ -273,6 +277,7 @@ static const struct blobmsg_policy notify_attr[__NOTIFY_LAST] = {
        [NOTIFY_ROUTES] = { .name = "routes", .type = BLOBMSG_TYPE_ARRAY },
        [NOTIFY_ROUTES6] = { .name = "routes6", .type = BLOBMSG_TYPE_ARRAY },
        [NOTIFY_TUNNEL] = { .name = "tunnel", .type = BLOBMSG_TYPE_TABLE },
+       [NOTIFY_DATA] = { .name = "data", .type = BLOBMSG_TYPE_TABLE },
 };
 
 static int
@@ -305,9 +310,6 @@ proto_shell_update_link(struct proto_shell_state *state, struct blob_attr *data,
                if (!iface->main_dev.dev)
                        return UBUS_STATUS_INVALID_ARGUMENT;
        } else {
-               if (state->l3_dev.dev)
-                       device_remove_user(&state->l3_dev);
-
                devname = blobmsg_data(tb[NOTIFY_IFNAME]);
                if (tb[NOTIFY_TUNNEL]) {
                        dev = proto_shell_create_tunnel(devname,
@@ -320,9 +322,8 @@ proto_shell_update_link(struct proto_shell_state *state, struct blob_attr *data,
                                return UBUS_STATUS_NOT_FOUND;
                }
 
-               device_add_user(&state->l3_dev, dev);
-               iface->l3_dev = &state->l3_dev;
-               device_claim(&state->l3_dev);
+               interface_set_l3_dev(iface, dev);
+               device_claim(&iface->l3_dev);
        }
 
        interface_update_start(iface);
@@ -338,6 +339,9 @@ proto_shell_update_link(struct proto_shell_state *state, struct blob_attr *data,
 
        state->proto.proto_event(&state->proto, IFPEV_UP);
 
+       if ((cur = tb[NOTIFY_DATA]))
+               proto_shell_parse_data(state->proto.iface, cur);
+
        return 0;
 }