fix use-after-free when an interface event is pending while the interface is being...

[project/netifd.git] / utils.c

diff --git a/utils.c b/utils.c
index 0b13f86..e5f3d89 100644 (file)
--- a/utils.c
+++ b/utils.c
@@ -9,10 +9,8 @@ avl_strcmp(const void *k1, const void *k2, void *ptr)
 }
 
 void
-__vlist_init(struct vlist_tree *tree, avl_tree_comp cmp,
-            vlist_update_cb update, int offset)
+vlist_init(struct vlist_tree *tree, avl_tree_comp cmp, vlist_update_cb update)
 {
-       tree->key_offset = offset;
        tree->update = update;
        tree->version = 1;
 
@@ -28,11 +26,10 @@ vlist_delete(struct vlist_tree *tree, struct vlist_node *node)
 }
 
 void
-vlist_add(struct vlist_tree *tree, struct vlist_node *node)
+vlist_add(struct vlist_tree *tree, struct vlist_node *node, void *key)
 {
        struct vlist_node *old_node = NULL;
        struct avl_node *anode;
-       void *key = (char *) node + tree->key_offset;
 
        node->avl.key = key;
        node->version = tree->version;
@@ -60,7 +57,8 @@ vlist_flush(struct vlist_tree *tree)
        struct vlist_node *node, *tmp;
 
        avl_for_each_element_safe(&tree->avl, node, avl, tmp) {
-               if (node->version == tree->version)
+               if ((node->version == tree->version || node->version == -1) &&
+                   tree->version != -1)
                        continue;
 
                vlist_delete(tree, node);
@@ -70,7 +68,7 @@ vlist_flush(struct vlist_tree *tree)
 void
 vlist_flush_all(struct vlist_tree *tree)
 {
-       tree->version++;
+       tree->version = -1;
        vlist_flush(tree);
 }
 
@@ -99,7 +97,8 @@ vlist_simple_flush(struct vlist_simple_tree *tree)
        struct vlist_simple_node *n, *tmp;
 
        list_for_each_entry_safe(n, tmp, &tree->list, list) {
-               if (n->version == tree->version)
+               if ((n->version == tree->version || n->version == -1) &&
+                   tree->version != -1)
                        continue;
 
                vlist_simple_delete(tree, n);
@@ -109,6 +108,6 @@ vlist_simple_flush(struct vlist_simple_tree *tree)
 void
 vlist_simple_flush_all(struct vlist_simple_tree *tree)
 {
-       tree->version++;
+       tree->version = -1;
        vlist_simple_flush(tree);
 }