projects
/
project
/
netifd.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
|
inline
| side by side (from parent 1:
8d18904
)
fix use-after-free on device free codepath due to recursion issues, and fix dev-...
author
Felix Fietkau
<nbd@openwrt.org>
Sun, 4 Dec 2011 19:16:49 +0000
(20:16 +0100)
committer
Felix Fietkau
<nbd@openwrt.org>
Sun, 4 Dec 2011 19:16:52 +0000
(20:16 +0100)
device.c
patch
|
blob
|
history
device.h
patch
|
blob
|
history
diff --git
a/device.c
b/device.c
index
b2db291
..
91cb37a
100644
(file)
--- a/
device.c
+++ b/
device.c
@@
-68,12
+68,17
@@
static int set_device_state(struct device *dev, bool state)
static int
simple_device_set_state(struct device *dev, bool state)
{
static int
simple_device_set_state(struct device *dev, bool state)
{
+ struct device *pdev;
int ret = 0;
int ret = 0;
- if (state && !dev->parent.dev)
- dev->parent.dev = system_if_get_parent(dev);
+ pdev = dev->parent.dev;
+ if (state && !pdev) {
+ pdev = system_if_get_parent(dev);
+ if (pdev)
+ device_add_user(&dev->parent, pdev);
+ }
- if (
dev->parent.
dev) {
+ if (
p
dev) {
if (state)
ret = device_claim(&dev->parent);
else
if (state)
ret = device_claim(&dev->parent);
else
@@
-425,6
+430,14
@@
void device_add_user(struct device_user *dep, struct device *dev)
}
}
}
}
+void
+device_free(struct device *dev)
+{
+ __devlock++;
+ dev->type->free(dev);
+ __devlock--;
+}
+
static void
__device_free_unused(struct device *dev)
{
static void
__device_free_unused(struct device *dev)
{
diff --git
a/device.h
b/device.h
index
0d9e6f4
..
c0b112d
100644
(file)
--- a/
device.h
+++ b/
device.h
@@
-148,12
+148,7
@@
void device_release(struct device_user *dep);
int device_check_state(struct device *dev);
void device_dump_status(struct blob_buf *b, struct device *dev);
int device_check_state(struct device *dev);
void device_dump_status(struct blob_buf *b, struct device *dev);
-static inline void
-device_free(struct device *dev)
-{
- dev->type->free(dev);
-}
-
+void device_free(struct device *dev);
void device_free_unused(struct device *dev);
struct device *get_vlan_device_chain(const char *ifname, bool create);
void device_free_unused(struct device *dev);
struct device *get_vlan_device_chain(const char *ifname, bool create);