netifd: Keep reference to a config copy in device type specific reload handler as...

Fixes random observed crashes in blobmsg_parse when device type specific
config data is parsed.

Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>

diff --git a/bridge.c b/bridge.c
index f8478ad698a9f0609c4a08ff7be14063113594d9..7076fd7f4bcb1b3e93ca7cfa54039c03dcb2b7ae 100644 (file)
--- a/bridge.c
+++ b/bridge.c
@@ -491,6 +491,7 @@ bridge_free(struct device *dev)
 
        bst = container_of(dev, struct bridge_state, dev);
        vlist_flush_all(&bst->members);
+       free(bst->config_data);
        free(bst);
 }
 
@@ -594,6 +595,7 @@ bridge_reload(struct device *dev, struct blob_attr *attr)
        BUILD_BUG_ON(sizeof(diff) < __DEV_ATTR_MAX / 8);
 
        bst = container_of(dev, struct bridge_state, dev);
+       attr = blob_memdup(attr);
 
        blobmsg_parse(device_attr_list.params, __DEV_ATTR_MAX, tb_dev,
                blob_data(attr), blob_len(attr));
@@ -627,6 +629,7 @@ bridge_reload(struct device *dev, struct blob_attr *attr)
                bridge_config_init(dev);
        }
 
+       free(bst->config_data);
        bst->config_data = attr;
        return ret;
 }

diff --git a/macvlan.c b/macvlan.c
index 019a7ffedce6db4f353f38c19275fcceb9ed0f09..051fe058960cd693410ace438c0b5423a6b58183 100644 (file)
--- a/macvlan.c
+++ b/macvlan.c
@@ -140,6 +140,7 @@ macvlan_free(struct device *dev)
 
        mvdev = container_of(dev, struct macvlan_device, dev);
        device_remove_user(&mvdev->parent);
+       free(mvdev->config_data);
        free(mvdev);
 }
 
@@ -197,6 +198,7 @@ macvlan_reload(struct device *dev, struct blob_attr *attr)
        struct macvlan_device *mvdev;
 
        mvdev = container_of(dev, struct macvlan_device, dev);
+       attr = blob_memdup(attr);
 
        blobmsg_parse(device_attr_list.params, __DEV_ATTR_MAX, tb_dev,
                blob_data(attr), blob_len(attr));
@@ -226,6 +228,7 @@ macvlan_reload(struct device *dev, struct blob_attr *attr)
                macvlan_config_init(dev);
        }
 
+       free(mvdev->config_data);
        mvdev->config_data = attr;
        return ret;
 }

diff --git a/vlandev.c b/vlandev.c
index 7b2038e93019b5f89207591c64c88b3721fffbc5..884e6efefaf439397843902cb2b855576da70835 100644 (file)
--- a/vlandev.c
+++ b/vlandev.c
@@ -131,6 +131,7 @@ vlandev_free(struct device *dev)
 
        mvdev = container_of(dev, struct vlandev_device, dev);
        device_remove_user(&mvdev->parent);
+       free(mvdev->config_data);
        free(mvdev);
 }
 
@@ -185,6 +186,7 @@ vlandev_reload(struct device *dev, struct blob_attr *attr)
        struct vlandev_device *mvdev;
 
        mvdev = container_of(dev, struct vlandev_device, dev);
+       attr = blob_memdup(attr);
 
        blobmsg_parse(device_attr_list.params, __DEV_ATTR_MAX, tb_dev,
                blob_data(attr), blob_len(attr));
@@ -214,6 +216,7 @@ vlandev_reload(struct device *dev, struct blob_attr *attr)
                vlandev_config_init(dev);
        }
 
+       free(mvdev->config_data);
        mvdev->config_data = attr;
        return ret;
 }