fix use-after-free on device free codepath due to recursion issues, and fix dev-...
[project/netifd.git] / device.c
1 #include <string.h>
2 #include <stdlib.h>
3 #include <stdio.h>
4 #include <assert.h>
5
6 #include <sys/types.h>
7 #include <sys/socket.h>
8 #include <net/ethernet.h>
9
10 #ifdef linux
11 #include <netinet/ether.h>
12 #endif
13
14 #include "netifd.h"
15 #include "system.h"
16 #include "config.h"
17
18 static struct avl_tree devices;
19 static struct avl_tree aliases;
20
21 struct alias_device {
22 struct avl_node avl;
23 struct device dev;
24 struct device_user dep;
25 bool cleanup;
26 char name[];
27 };
28
29 static const struct device_type alias_device_type;
30
31 static const struct blobmsg_policy dev_attrs[__DEV_ATTR_MAX] = {
32 [DEV_ATTR_TYPE] = { "type", BLOBMSG_TYPE_STRING },
33 [DEV_ATTR_IFNAME] = { "ifname", BLOBMSG_TYPE_ARRAY },
34 [DEV_ATTR_MTU] = { "mtu", BLOBMSG_TYPE_INT32 },
35 [DEV_ATTR_MACADDR] = { "macaddr", BLOBMSG_TYPE_STRING },
36 [DEV_ATTR_TXQUEUELEN] = { "txqueuelen", BLOBMSG_TYPE_INT32 },
37 };
38
39 const struct config_param_list device_attr_list = {
40 .n_params = __DEV_ATTR_MAX,
41 .params = dev_attrs,
42 };
43
44 static int __devlock = 0;
45
46 void device_lock(void)
47 {
48 __devlock++;
49 }
50
51 void device_unlock(void)
52 {
53 __devlock--;
54 if (!__devlock)
55 device_free_unused(NULL);
56 }
57
58 static int set_device_state(struct device *dev, bool state)
59 {
60 if (state)
61 system_if_up(dev);
62 else
63 system_if_down(dev);
64
65 return 0;
66 }
67
68 static int
69 simple_device_set_state(struct device *dev, bool state)
70 {
71 struct device *pdev;
72 int ret = 0;
73
74 pdev = dev->parent.dev;
75 if (state && !pdev) {
76 pdev = system_if_get_parent(dev);
77 if (pdev)
78 device_add_user(&dev->parent, pdev);
79 }
80
81 if (pdev) {
82 if (state)
83 ret = device_claim(&dev->parent);
84 else
85 device_release(&dev->parent);
86
87 if (ret < 0)
88 return ret;
89 }
90 return set_device_state(dev, state);
91 }
92
93 static struct device *
94 simple_device_create(const char *name, struct blob_attr *attr)
95 {
96 struct blob_attr *tb[__DEV_ATTR_MAX];
97 struct device *dev = NULL;
98
99 blobmsg_parse(dev_attrs, __DEV_ATTR_MAX, tb, blob_data(attr), blob_len(attr));
100 dev = device_get(name, true);
101 if (!dev)
102 return NULL;
103
104 dev->set_state = simple_device_set_state;
105 device_init_settings(dev, tb);
106
107 return dev;
108 }
109
110 static void simple_device_free(struct device *dev)
111 {
112 if (dev->parent.dev)
113 device_remove_user(&dev->parent);
114 device_cleanup(dev);
115 free(dev);
116 }
117
118 const struct device_type simple_device_type = {
119 .name = "Network device",
120 .config_params = &device_attr_list,
121
122 .create = simple_device_create,
123 .check_state = system_if_check,
124 .free = simple_device_free,
125 };
126
127 static int
128 alias_device_set_state(struct device *dev, bool state)
129 {
130 struct alias_device *alias;
131
132 alias = container_of(dev, struct alias_device, dev);
133 if (!alias->dep.dev)
134 return -1;
135
136 if (state)
137 return device_claim(&alias->dep);
138
139 device_release(&alias->dep);
140 if (alias->cleanup)
141 device_remove_user(&alias->dep);
142 return 0;
143 }
144
145 static struct device *
146 alias_device_create(const char *name, struct blob_attr *attr)
147 {
148 struct alias_device *alias;
149
150 alias = calloc(1, sizeof(*alias) + strlen(name) + 1);
151 strcpy(alias->name, name);
152 alias->dev.set_state = alias_device_set_state;
153 device_init_virtual(&alias->dev, &alias_device_type, NULL);
154 alias->avl.key = alias->name;
155 avl_insert(&aliases, &alias->avl);
156
157 return &alias->dev;
158 }
159
160 static void alias_device_free(struct device *dev)
161 {
162 struct alias_device *alias;
163
164 device_cleanup(dev);
165
166 alias = container_of(dev, struct alias_device, dev);
167 avl_delete(&aliases, &alias->avl);
168 free(alias);
169 }
170
171 static const struct device_type alias_device_type = {
172 .name = "Network alias",
173 .create = alias_device_create,
174 .free = alias_device_free,
175 };
176
177 void
178 device_init_settings(struct device *dev, struct blob_attr **tb)
179 {
180 struct blob_attr *cur;
181 struct ether_addr *ea;
182
183 dev->flags = 0;
184
185 if ((cur = tb[DEV_ATTR_MTU])) {
186 dev->mtu = blobmsg_get_u32(cur);
187 dev->flags |= DEV_OPT_MTU;
188 }
189
190 if ((cur = tb[DEV_ATTR_TXQUEUELEN])) {
191 dev->txqueuelen = blobmsg_get_u32(cur);
192 dev->flags |= DEV_OPT_TXQUEUELEN;
193 }
194
195 if ((cur = tb[DEV_ATTR_MACADDR])) {
196 ea = ether_aton(blob_data(cur));
197 if (ea) {
198 memcpy(dev->macaddr, ea, sizeof(dev->macaddr));
199 dev->flags |= DEV_OPT_MACADDR;
200 }
201 }
202 }
203
204 static void __init dev_init(void)
205 {
206 avl_init(&devices, avl_strcmp, true, NULL);
207 avl_init(&aliases, avl_strcmp, false, NULL);
208 }
209
210 static void device_broadcast_event(struct device *dev, enum device_event ev)
211 {
212 struct device_user *dep, *tmp;
213
214 list_for_each_entry_safe(dep, tmp, &dev->users, list) {
215 if (!dep->cb)
216 continue;
217
218 dep->cb(dep, ev);
219 }
220 }
221
222 void
223 alias_notify_device(const char *name, struct device *dev)
224 {
225 struct alias_device *alias;
226
227 device_lock();
228
229 alias = avl_find_element(&aliases, name, alias, avl);
230 if (!alias)
231 return;
232
233 alias->cleanup = !dev;
234 if (dev) {
235 if (dev != alias->dep.dev) {
236 device_remove_user(&alias->dep);
237 strcpy(alias->dev.ifname, dev->ifname);
238 device_add_user(&alias->dep, dev);
239 }
240 }
241
242 device_set_present(&alias->dev, !!dev);
243
244 if (!dev && alias->dep.dev && !alias->dep.dev->active)
245 device_remove_user(&alias->dep);
246
247 device_unlock();
248 }
249
250 int device_claim(struct device_user *dep)
251 {
252 struct device *dev = dep->dev;
253 int ret;
254
255 if (dep->claimed)
256 return 0;
257
258 dep->claimed = true;
259 D(DEVICE, "Claim %s %s, new refcount: %d\n", dev->type->name, dev->ifname, dev->active + 1);
260 if (++dev->active != 1)
261 return 0;
262
263 device_broadcast_event(dev, DEV_EVENT_SETUP);
264 ret = dev->set_state(dev, true);
265 if (ret == 0)
266 device_broadcast_event(dev, DEV_EVENT_UP);
267 else {
268 D(DEVICE, "claim device %s failed: %d\n", dev->ifname, ret);
269 dev->active = 0;
270 dep->claimed = false;
271 }
272
273 return ret;
274 }
275
276 void device_release(struct device_user *dep)
277 {
278 struct device *dev = dep->dev;
279
280 if (!dep->claimed)
281 return;
282
283 dep->claimed = false;
284 dev->active--;
285 D(DEVICE, "Release %s %s, new refcount: %d\n", dev->type->name, dev->ifname, dev->active);
286 assert(dev->active >= 0);
287
288 if (dev->active)
289 return;
290
291 device_broadcast_event(dev, DEV_EVENT_TEARDOWN);
292 dev->set_state(dev, false);
293 device_broadcast_event(dev, DEV_EVENT_DOWN);
294 }
295
296 int device_check_state(struct device *dev)
297 {
298 if (!dev->type->check_state)
299 return 0;
300
301 return dev->type->check_state(dev);
302 }
303
304 void device_init_virtual(struct device *dev, const struct device_type *type, const char *name)
305 {
306 assert(dev);
307 assert(type);
308
309 if (name)
310 strncpy(dev->ifname, name, IFNAMSIZ);
311
312 D(DEVICE, "Initialize device '%s'\n", dev->ifname);
313 INIT_LIST_HEAD(&dev->users);
314 dev->type = type;
315 }
316
317 int device_init(struct device *dev, const struct device_type *type, const char *ifname)
318 {
319 int ret;
320
321 device_init_virtual(dev, type, ifname);
322
323 if (!dev->set_state)
324 dev->set_state = set_device_state;
325
326 dev->avl.key = dev->ifname;
327
328 ret = avl_insert(&devices, &dev->avl);
329 if (ret < 0)
330 return ret;
331
332 system_if_clear_state(dev);
333 device_check_state(dev);
334
335 return 0;
336 }
337
338 static struct device *
339 device_create_default(const char *name, bool external)
340 {
341 struct device *dev;
342
343 D(DEVICE, "Create simple device '%s'\n", name);
344 dev = calloc(1, sizeof(*dev));
345 dev->external = external;
346 dev->set_state = simple_device_set_state;
347 device_init(dev, &simple_device_type, name);
348 dev->default_config = true;
349 return dev;
350 }
351
352 static struct device *
353 device_alias_get(const char *name)
354 {
355 struct alias_device *alias;
356
357 alias = avl_find_element(&aliases, name, alias, avl);
358 if (alias)
359 return &alias->dev;
360
361 return alias_device_create(name, NULL);
362 }
363
364 struct device *
365 device_get(const char *name, int create)
366 {
367 struct device *dev;
368
369 if (strchr(name, '.'))
370 return get_vlan_device_chain(name, create);
371
372 if (name[0] == '@')
373 return device_alias_get(name + 1);
374
375 dev = avl_find_element(&devices, name, dev, avl);
376 if (dev)
377 return dev;
378
379 if (!create)
380 return NULL;
381
382 return device_create_default(name, create > 1);
383 }
384
385 static void
386 device_delete(struct device *dev)
387 {
388 if (!dev->avl.key)
389 return;
390
391 D(DEVICE, "Delete device '%s' from list\n", dev->ifname);
392 avl_delete(&devices, &dev->avl);
393 dev->avl.key = NULL;
394 }
395
396 void device_cleanup(struct device *dev)
397 {
398 struct device_user *dep, *tmp;
399
400 D(DEVICE, "Clean up device '%s'\n", dev->ifname);
401 list_for_each_entry_safe(dep, tmp, &dev->users, list) {
402 if (!dep->cb)
403 continue;
404
405 dep->cb(dep, DEV_EVENT_REMOVE);
406 device_release(dep);
407 }
408
409 device_delete(dev);
410 }
411
412 void device_set_present(struct device *dev, bool state)
413 {
414 if (dev->present == state)
415 return;
416
417 D(DEVICE, "%s '%s' %s present\n", dev->type->name, dev->ifname, state ? "is now" : "is no longer" );
418 dev->present = state;
419 device_broadcast_event(dev, state ? DEV_EVENT_ADD : DEV_EVENT_REMOVE);
420 }
421
422 void device_add_user(struct device_user *dep, struct device *dev)
423 {
424 dep->dev = dev;
425 list_add_tail(&dep->list, &dev->users);
426 if (dep->cb && dev->present) {
427 dep->cb(dep, DEV_EVENT_ADD);
428 if (dev->active)
429 dep->cb(dep, DEV_EVENT_UP);
430 }
431 }
432
433 void
434 device_free(struct device *dev)
435 {
436 __devlock++;
437 dev->type->free(dev);
438 __devlock--;
439 }
440
441 static void
442 __device_free_unused(struct device *dev)
443 {
444 if (!list_empty(&dev->users) || dev->current_config || __devlock)
445 return;
446
447 device_free(dev);
448 }
449
450 void device_remove_user(struct device_user *dep)
451 {
452 struct device *dev = dep->dev;
453
454 if (!dep->dev)
455 return;
456
457 dep->hotplug = false;
458 if (dep->claimed)
459 device_release(dep);
460
461 list_del(&dep->list);
462 dep->dev = NULL;
463 __device_free_unused(dev);
464 }
465
466 void
467 device_free_unused(struct device *dev)
468 {
469 struct device *tmp;
470
471 if (dev)
472 return __device_free_unused(dev);
473
474 avl_for_each_element_safe(&devices, dev, avl, tmp)
475 __device_free_unused(dev);
476 }
477
478 void
479 device_init_pending(void)
480 {
481 struct device *dev, *tmp;
482
483 avl_for_each_element_safe(&devices, dev, avl, tmp) {
484 if (!dev->config_pending)
485 continue;
486
487 dev->type->config_init(dev);
488 dev->config_pending = false;
489 }
490 }
491
492 static enum dev_change_type
493 device_reload_config(struct device *dev, struct blob_attr *attr)
494 {
495 struct blob_attr *tb[__DEV_ATTR_MAX];
496 const struct config_param_list *cfg = dev->type->config_params;
497
498 if (config_check_equal(dev->config, attr, cfg))
499 return DEV_CONFIG_NO_CHANGE;
500
501 if (cfg == &device_attr_list) {
502 memset(tb, 0, sizeof(tb));
503
504 if (attr)
505 blobmsg_parse(dev_attrs, __DEV_ATTR_MAX, tb,
506 blob_data(attr), blob_len(attr));
507
508 device_init_settings(dev, tb);
509 return DEV_CONFIG_APPLIED;
510 } else
511 return DEV_CONFIG_RECREATE;
512 }
513
514 enum dev_change_type
515 device_set_config(struct device *dev, const struct device_type *type,
516 struct blob_attr *attr)
517 {
518 if (type != dev->type)
519 return DEV_CONFIG_RECREATE;
520
521 if (dev->type->reload)
522 return dev->type->reload(dev, attr);
523
524 return device_reload_config(dev, attr);
525 }
526
527 static void
528 device_replace(struct device *dev, struct device *odev)
529 {
530 struct device_user *dep, *tmp;
531 bool present = odev->present;
532
533 if (present)
534 device_set_present(odev, false);
535
536 list_for_each_entry_safe(dep, tmp, &odev->users, list) {
537 device_release(dep);
538 list_move_tail(&dep->list, &dev->users);
539 dep->dev = dev;
540 }
541 device_free(odev);
542
543 if (present)
544 device_set_present(dev, true);
545 }
546
547 void
548 device_reset_config(void)
549 {
550 struct device *dev;
551
552 avl_for_each_element(&devices, dev, avl)
553 dev->current_config = false;
554 }
555
556 void
557 device_reset_old(void)
558 {
559 struct device *dev, *tmp, *ndev;
560
561 avl_for_each_element_safe(&devices, dev, avl, tmp) {
562 if (dev->current_config || dev->default_config)
563 continue;
564
565 if (dev->type != &simple_device_type)
566 continue;
567
568 ndev = device_create_default(dev->ifname, dev->external);
569 device_replace(ndev, dev);
570 }
571 }
572
573 struct device *
574 device_create(const char *name, const struct device_type *type,
575 struct blob_attr *config)
576 {
577 struct device *odev = NULL, *dev;
578 enum dev_change_type change;
579
580 config = config_memdup(config);
581 if (!config)
582 return NULL;
583
584 odev = device_get(name, false);
585 if (odev) {
586 odev->current_config = true;
587 change = device_set_config(odev, type, config);
588 switch (change) {
589 case DEV_CONFIG_APPLIED:
590 D(DEVICE, "Device '%s': config applied\n", odev->ifname);
591 free(odev->config);
592 odev->config = config;
593 if (odev->present) {
594 device_set_present(odev, false);
595 device_set_present(odev, true);
596 }
597 return odev;
598 case DEV_CONFIG_NO_CHANGE:
599 D(DEVICE, "Device '%s': no configuration change\n", odev->ifname);
600 free(config);
601 return odev;
602 case DEV_CONFIG_RECREATE:
603 D(DEVICE, "Device '%s': recreate device\n", odev->ifname);
604 device_delete(odev);
605 break;
606 }
607 } else
608 D(DEVICE, "Create new device '%s' (%s)\n", name, type->name);
609
610 dev = type->create(name, config);
611 if (!dev)
612 return NULL;
613
614 dev->current_config = true;
615 dev->config = config;
616 if (odev)
617 device_replace(dev, odev);
618
619 if (!config_init && dev->config_pending)
620 type->config_init(dev);
621
622 return dev;
623 }
624
625 void
626 device_dump_status(struct blob_buf *b, struct device *dev)
627 {
628 void *c, *s;
629
630 if (!dev) {
631 avl_for_each_element(&devices, dev, avl) {
632 if (!dev->present)
633 continue;
634 c = blobmsg_open_table(b, dev->ifname);
635 device_dump_status(b, dev);
636 blobmsg_close_table(b, c);
637 }
638
639 return;
640 }
641
642 if (!dev->present)
643 return;
644
645 blobmsg_add_string(b, "type", dev->type->name);
646 blobmsg_add_u8(b, "up", !!dev->active);
647 if (dev->type->dump_info)
648 dev->type->dump_info(dev, b);
649
650 s = blobmsg_open_table(b, "statistics");
651 if (dev->type->dump_stats)
652 dev->type->dump_stats(dev, b);
653 else
654 system_if_dump_stats(dev, b);
655 blobmsg_close_table(b, s);
656 }