bridge: fix use-after-free bug on bridge member free

When removing the device reference, the core might free the device.
Use device_lock/unlock to keep the reference valid until it is no longer needed

Signed-off-by: Felix Fietkau <nbd@nbd.name>

1 files changed, 4 insertions, 0 deletions

diff --git a/bridge.c b/bridge.c
index 91036d2..eebd8e9 100644
--- a/bridge.c
+++ b/bridge.c
@@ -447,6 +447,8 @@ bridge_free_member(struct bridge_member *bm)
 		}
 	}
 
+	device_lock();
+
 	device_remove_user(&bm->dev);
 
 	/*
@@ -461,6 +463,8 @@ bridge_free_member(struct bridge_member *bm)
 		device_set_present(dev, true);
 	}
 
+	device_unlock();
+
 	free(bm);
 }