From: Felix Fietkau <nbd@openwrt.org>
Date: Mon, 19 Mar 2012 20:38:13 +0000 (+0100)
Subject: move device cleanup to common code, fixes use-after-free in tunnel code
X-Git-Url: http://git.archive.openwrt.org/?p=project%2Fnetifd.git;a=commitdiff_plain;h=49bf4946296b22f7c26594ac310879d6059344d4

move device cleanup to common code, fixes use-after-free in tunnel code
---

diff --git a/bridge.c b/bridge.c
index 9967985..da07d9c 100644
--- a/bridge.c
+++ b/bridge.c
@@ -343,7 +343,6 @@ bridge_free(struct device *dev)
 {
 	struct bridge_state *bst;
 
-	device_cleanup(dev);
 	bst = container_of(dev, struct bridge_state, dev);
 	vlist_flush_all(&bst->members);
 	free(bst);
diff --git a/device.c b/device.c
index 46177a2..47b5875 100644
--- a/device.c
+++ b/device.c
@@ -112,7 +112,6 @@ static void simple_device_free(struct device *dev)
 {
 	if (dev->parent.dev)
 		device_remove_user(&dev->parent);
-	device_cleanup(dev);
 	free(dev);
 }
 
@@ -162,8 +161,6 @@ static void alias_device_free(struct device *dev)
 {
 	struct alias_device *alias;
 
-	device_cleanup(dev);
-
 	alias = container_of(dev, struct alias_device, dev);
 	avl_delete(&aliases, &alias->avl);
 	free(alias);
@@ -483,6 +480,7 @@ device_free(struct device *dev)
 {
 	__devlock++;
 	free(dev->config);
+	device_cleanup(dev);
 	dev->type->free(dev);
 	__devlock--;
 }