move device cleanup to common code, fixes use-after-free in tunnel code

diff --git a/bridge.c b/bridge.c
index 9967985..da07d9c 100644 (file)
--- a/bridge.c
+++ b/bridge.c
@@ -343,7 +343,6 @@ bridge_free(struct device *dev)
 {
        struct bridge_state *bst;
 
-       device_cleanup(dev);
        bst = container_of(dev, struct bridge_state, dev);
        vlist_flush_all(&bst->members);
        free(bst);

diff --git a/device.c b/device.c
index 46177a2..47b5875 100644 (file)
--- a/device.c
+++ b/device.c
@@ -112,7 +112,6 @@ static void simple_device_free(struct device *dev)
 {
        if (dev->parent.dev)
                device_remove_user(&dev->parent);
-       device_cleanup(dev);
        free(dev);
 }
 
@@ -162,8 +161,6 @@ static void alias_device_free(struct device *dev)
 {
        struct alias_device *alias;
 
-       device_cleanup(dev);
-
        alias = container_of(dev, struct alias_device, dev);
        avl_delete(&aliases, &alias->avl);
        free(alias);
@@ -483,6 +480,7 @@ device_free(struct device *dev)
 {
        __devlock++;
        free(dev->config);
+       device_cleanup(dev);
        dev->type->free(dev);
        __devlock--;
 }