fix a double free / use after free
[project/netifd.git] / device.c
1 #include <string.h>
2 #include <stdlib.h>
3 #include <stdio.h>
4 #include <assert.h>
5
6 #include <sys/types.h>
7 #include <sys/socket.h>
8 #include <net/ethernet.h>
9
10 #ifdef linux
11 #include <netinet/ether.h>
12 #endif
13
14 #include "netifd.h"
15 #include "system.h"
16 #include "config.h"
17
18 static struct avl_tree devices;
19
20 static const struct blobmsg_policy dev_attrs[__DEV_ATTR_MAX] = {
21 [DEV_ATTR_TYPE] = { "type", BLOBMSG_TYPE_STRING },
22 [DEV_ATTR_NAME] = { "name", BLOBMSG_TYPE_STRING },
23 [DEV_ATTR_IFNAME] = { "ifname", BLOBMSG_TYPE_ARRAY },
24 [DEV_ATTR_MTU] = { "mtu", BLOBMSG_TYPE_INT32 },
25 [DEV_ATTR_MACADDR] = { "macaddr", BLOBMSG_TYPE_STRING },
26 [DEV_ATTR_TXQUEUELEN] = { "txqueuelen", BLOBMSG_TYPE_INT32 },
27 };
28
29 const struct config_param_list device_attr_list = {
30 .n_params = __DEV_ATTR_MAX,
31 .params = dev_attrs,
32 };
33
34 static struct device *
35 simple_device_create(struct blob_attr *attr)
36 {
37 struct blob_attr *tb[__DEV_ATTR_MAX];
38 struct device *dev = NULL;
39 const char *name;
40
41 blobmsg_parse(dev_attrs, __DEV_ATTR_MAX, tb, blob_data(attr), blob_len(attr));
42 if (!tb[DEV_ATTR_NAME])
43 return NULL;
44
45 name = blobmsg_data(tb[DEV_ATTR_NAME]);
46 if (!name)
47 return NULL;
48
49 dev = device_get(name, true);
50 if (!dev)
51 return NULL;
52
53 device_init_settings(dev, tb);
54
55 return dev;
56 }
57
58 static void simple_device_free(struct device *dev)
59 {
60 device_cleanup(dev);
61 free(dev);
62 }
63
64 const struct device_type simple_device_type = {
65 .name = "Network device",
66 .config_params = &device_attr_list,
67
68 .create = simple_device_create,
69 .check_state = system_if_check,
70 .free = simple_device_free,
71 };
72
73 void
74 device_init_settings(struct device *dev, struct blob_attr **tb)
75 {
76 struct blob_attr *cur;
77 struct ether_addr *ea;
78
79 dev->flags = 0;
80
81 if ((cur = tb[DEV_ATTR_MTU])) {
82 dev->mtu = blobmsg_get_u32(cur);
83 dev->flags |= DEV_OPT_MTU;
84 }
85
86 if ((cur = tb[DEV_ATTR_TXQUEUELEN])) {
87 dev->txqueuelen = blobmsg_get_u32(cur);
88 dev->flags |= DEV_OPT_TXQUEUELEN;
89 }
90
91 if ((cur = tb[DEV_ATTR_MACADDR])) {
92 ea = ether_aton(blob_data(cur));
93 if (ea) {
94 memcpy(dev->macaddr, ea, sizeof(dev->macaddr));
95 dev->flags |= DEV_OPT_MACADDR;
96 }
97 }
98 }
99
100 static void __init dev_init(void)
101 {
102 avl_init(&devices, avl_strcmp, true, NULL);
103 }
104
105 static void device_broadcast_event(struct device *dev, enum device_event ev)
106 {
107 struct device_user *dep, *tmp;
108
109 list_for_each_entry_safe(dep, tmp, &dev->users, list) {
110 if (!dep->cb)
111 continue;
112
113 dep->cb(dep, ev);
114 }
115 }
116
117 static int set_device_state(struct device *dev, bool state)
118 {
119 if (state)
120 system_if_up(dev);
121 else
122 system_if_down(dev);
123
124 return 0;
125 }
126
127 int device_claim(struct device_user *dep)
128 {
129 struct device *dev = dep->dev;
130 int ret;
131
132 if (dep->claimed)
133 return 0;
134
135 dep->claimed = true;
136 D(DEVICE, "claim device %s, new refcount: %d\n", dev->ifname, dev->active + 1);
137 if (++dev->active != 1)
138 return 0;
139
140 device_broadcast_event(dev, DEV_EVENT_SETUP);
141 ret = dev->set_state(dev, true);
142 if (ret == 0)
143 device_broadcast_event(dev, DEV_EVENT_UP);
144 else
145 dev->active = 0;
146
147 return ret;
148 }
149
150 void device_release(struct device_user *dep)
151 {
152 struct device *dev = dep->dev;
153
154 if (!dep->claimed)
155 return;
156
157 dep->claimed = false;
158 dev->active--;
159 D(DEVICE, "release device %s, new refcount: %d\n", dev->ifname, dev->active);
160 assert(dev->active >= 0);
161
162 if (dev->active)
163 return;
164
165 device_broadcast_event(dev, DEV_EVENT_TEARDOWN);
166 dev->set_state(dev, false);
167 device_broadcast_event(dev, DEV_EVENT_DOWN);
168 }
169
170 int device_check_state(struct device *dev)
171 {
172 if (!dev->type->check_state)
173 return 0;
174
175 return dev->type->check_state(dev);
176 }
177
178 void device_init_virtual(struct device *dev, const struct device_type *type, const char *name)
179 {
180 assert(dev);
181 assert(type);
182
183 if (name)
184 strncpy(dev->ifname, name, IFNAMSIZ);
185
186 D(DEVICE, "Initialize device '%s'\n", dev->ifname);
187 INIT_LIST_HEAD(&dev->users);
188 dev->type = type;
189 }
190
191 int device_init(struct device *dev, const struct device_type *type, const char *ifname)
192 {
193 int ret;
194
195 device_init_virtual(dev, type, ifname);
196
197 if (!dev->set_state)
198 dev->set_state = set_device_state;
199
200 dev->avl.key = dev->ifname;
201
202 ret = avl_insert(&devices, &dev->avl);
203 if (ret < 0)
204 return ret;
205
206 device_check_state(dev);
207
208 return 0;
209 }
210
211 static struct device *
212 device_create_default(const char *name)
213 {
214 struct device *dev;
215
216 D(DEVICE, "Create simple device '%s'\n", name);
217 dev = calloc(1, sizeof(*dev));
218 device_init(dev, &simple_device_type, name);
219 dev->default_config = true;
220 return dev;
221 }
222
223 struct device *
224 device_get(const char *name, bool create)
225 {
226 struct device *dev;
227
228 if (strchr(name, '.'))
229 return get_vlan_device_chain(name, create);
230
231 dev = avl_find_element(&devices, name, dev, avl);
232 if (dev)
233 return dev;
234
235 if (!create)
236 return NULL;
237
238 return device_create_default(name);
239 }
240
241 static void
242 device_delete(struct device *dev)
243 {
244 if (!dev->avl.key)
245 return;
246
247 D(DEVICE, "Delete device '%s' from list\n", dev->ifname);
248 avl_delete(&devices, &dev->avl);
249 dev->avl.key = NULL;
250 }
251
252 void device_cleanup(struct device *dev)
253 {
254 struct device_user *dep, *tmp;
255
256 D(DEVICE, "Clean up device '%s'\n", dev->ifname);
257 list_for_each_entry_safe(dep, tmp, &dev->users, list) {
258 if (!dep->cb)
259 continue;
260
261 dep->cb(dep, DEV_EVENT_REMOVE);
262 }
263
264 device_delete(dev);
265 }
266
267 void device_set_present(struct device *dev, bool state)
268 {
269 if (dev->present == state)
270 return;
271
272 D(DEVICE, "Device '%s' %s present\n", dev->ifname, state ? "is now" : "is no longer" );
273 dev->present = state;
274 device_broadcast_event(dev, state ? DEV_EVENT_ADD : DEV_EVENT_REMOVE);
275 }
276
277 void device_add_user(struct device_user *dep, struct device *dev)
278 {
279 dep->dev = dev;
280 list_add_tail(&dep->list, &dev->users);
281 if (dep->cb && dev->present) {
282 dep->cb(dep, DEV_EVENT_ADD);
283 if (dev->active)
284 dep->cb(dep, DEV_EVENT_UP);
285 }
286 }
287
288 static void
289 __device_free_unused(struct device *dev)
290 {
291 if (!list_empty(&dev->users) || dev->current_config)
292 return;
293
294 device_free(dev);
295 }
296
297 void device_remove_user(struct device_user *dep)
298 {
299 struct device *dev = dep->dev;
300
301 if (dep->claimed)
302 device_release(dep);
303
304 list_del(&dep->list);
305 dep->dev = NULL;
306 __device_free_unused(dev);
307 }
308
309 void
310 device_free_unused(struct device *dev)
311 {
312 struct device *tmp;
313
314 if (dev)
315 return __device_free_unused(dev);
316
317 avl_for_each_element_safe(&devices, dev, avl, tmp)
318 __device_free_unused(dev);
319 }
320
321 void
322 device_init_pending(void)
323 {
324 struct device *dev, *tmp;
325
326 avl_for_each_element_safe(&devices, dev, avl, tmp) {
327 if (!dev->config_pending)
328 continue;
329
330 dev->type->config_init(dev);
331 dev->config_pending = false;
332 }
333 }
334
335 enum dev_change_type
336 device_reload_config(struct device *dev, struct blob_attr *attr)
337 {
338 struct blob_attr *tb[__DEV_ATTR_MAX], *tb1[__DEV_ATTR_MAX];
339
340 blobmsg_parse(dev_attrs, __DEV_ATTR_MAX, tb,
341 blob_data(attr), blob_len(attr));
342 if (dev->config)
343 blobmsg_parse(dev_attrs, __DEV_ATTR_MAX, tb1,
344 blob_data(dev->config), blob_len(dev->config));
345 else
346 memset(tb1, 0, sizeof(tb1));
347
348 if (!config_diff(tb, tb1, &device_attr_list, NULL))
349 return DEV_CONFIG_NO_CHANGE;
350
351 device_init_settings(dev, tb);
352 return DEV_CONFIG_APPLIED;
353 }
354
355 static enum dev_change_type
356 device_check_config(struct device *dev, const struct device_type *type,
357 struct blob_attr *attr)
358 {
359 if (type != dev->type)
360 return DEV_CONFIG_RECREATE;
361
362 if (dev->type->reload)
363 return dev->type->reload(dev, attr);
364
365 return device_reload_config(dev, attr);
366 }
367
368 static void
369 device_replace(struct device *dev, struct device *odev)
370 {
371 struct device_user *dep, *tmp;
372 bool present = odev->present;
373
374 if (present)
375 device_set_present(odev, false);
376
377 list_for_each_entry_safe(dep, tmp, &odev->users, list) {
378 device_remove_user(dep);
379 device_add_user(dep, dev);
380 }
381 device_free(odev);
382
383 if (present)
384 device_set_present(dev, true);
385 }
386
387 void
388 device_reset_config(void)
389 {
390 struct device *dev;
391
392 avl_for_each_element(&devices, dev, avl)
393 dev->current_config = false;
394 }
395
396 void
397 device_reset_old(void)
398 {
399 struct device *dev, *tmp, *ndev;
400
401 avl_for_each_element_safe(&devices, dev, avl, tmp) {
402 if (dev->current_config || dev->default_config)
403 continue;
404
405 if (dev->type != &simple_device_type)
406 continue;
407
408 ndev = device_create_default(dev->ifname);
409 device_replace(ndev, dev);
410 }
411 }
412
413 struct device *
414 device_create(const char *name, const struct device_type *type,
415 struct blob_attr *config)
416 {
417 struct device *odev = NULL, *dev;
418 enum dev_change_type change;
419
420 D(DEVICE, "Create new device '%s' (%s)\n", name, type->name);
421 config = config_memdup(config);
422 if (!config)
423 return NULL;
424
425 odev = device_get(name, false);
426 if (odev) {
427 odev->current_config = true;
428 change = device_check_config(odev, type, config);
429 switch (change) {
430 case DEV_CONFIG_APPLIED:
431 D(DEVICE, "Device '%s': config applied\n", odev->ifname);
432 free(odev->config);
433 odev->config = config;
434 if (odev->present) {
435 device_set_present(odev, false);
436 device_set_present(odev, true);
437 }
438 return odev;
439 case DEV_CONFIG_NO_CHANGE:
440 D(DEVICE, "Device '%s': no configuration change\n", odev->ifname);
441 free(config);
442 return odev;
443 case DEV_CONFIG_RECREATE:
444 D(DEVICE, "Device '%s': recreate device\n", odev->ifname);
445 device_delete(odev);
446 break;
447 }
448 }
449
450 dev = type->create(config);
451 if (!dev)
452 return NULL;
453
454 dev->current_config = true;
455 dev->config = config;
456 if (odev)
457 device_replace(dev, odev);
458
459 if (!config_init && dev->config_pending)
460 type->config_init(dev);
461
462 return dev;
463 }