projects
/
project
/
netifd.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
netifd: fix a use-after-free issue on wireless config update
[project/netifd.git]
/
ubus.c
diff --git
a/ubus.c
b/ubus.c
index
b81136b
..
02becf2
100644
(file)
--- a/
ubus.c
+++ b/
ubus.c
@@
-147,13
+147,16
@@
netifd_add_dynamic(struct ubus_context *ctx, struct ubus_object *obj,
goto error;
interface_add(iface, config);
goto error;
interface_add(iface, config);
- interface_set_dynamic(iface);
- // need to look up the interface name again, in case of config update,
+ // need to look up the interface name again, in case of config update
+ // the pointer will have changed
iface = vlist_find(&interfaces, name, iface, node);
if (!iface)
return UBUS_STATUS_UNKNOWN_ERROR;
iface = vlist_find(&interfaces, name, iface, node);
if (!iface)
return UBUS_STATUS_UNKNOWN_ERROR;
+ // Set interface as dynamic
+ interface_set_dynamic(iface);
+
dev = iface->main_dev.dev;
if (!dev || !dev->default_config)
return UBUS_STATUS_UNKNOWN_ERROR;
dev = iface->main_dev.dev;
if (!dev || !dev->default_config)
return UBUS_STATUS_UNKNOWN_ERROR;
@@
-650,7
+653,8
@@
netifd_dump_status(struct interface *iface)
if (iface->state == IFS_UP) {
time_t cur = system_get_rtime();
blobmsg_add_u32(&b, "uptime", cur - iface->start_time);
if (iface->state == IFS_UP) {
time_t cur = system_get_rtime();
blobmsg_add_u32(&b, "uptime", cur - iface->start_time);
- blobmsg_add_string(&b, "l3_device", iface->l3_dev.dev->ifname);
+ if (iface->l3_dev.dev)
+ blobmsg_add_string(&b, "l3_device", iface->l3_dev.dev->ifname);
}
if (iface->proto_handler)
}
if (iface->proto_handler)
@@
-737,11
+741,11
@@
netifd_dump_status(struct interface *iface)
a = blobmsg_open_table(&b, "data");
avl_for_each_element(&iface->data, data, node)
a = blobmsg_open_table(&b, "data");
avl_for_each_element(&iface->data, data, node)
- blob
_put(&b, blob_id(data->data), blob_data(data->data), blob_len(data->data)
);
+ blob
msg_add_blob(&b, data->data
);
blobmsg_close_table(&b, a);
blobmsg_close_table(&b, a);
- if (!list_
is_
empty(&iface->errors))
+ if (!list_empty(&iface->errors))
netifd_add_interface_errors(&b, iface);
}
netifd_add_interface_errors(&b, iface);
}