Eric Lee / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit b4ec824021493ba6cb7eeb61572f4d2f8a80a52e

Authored by Eric Dumazet
Committed by David S. Miller
1 parent 1056bd5167
Exists in master and in 39 other branches 8mp-imx_5.4.70_2.3.0, 8qm-imx_5.4.70_2.3.0, emb_imx_lf-5.15.y, emb_lf-6.1.y, imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, imx_4.1.15_1.0.0_ga, pitx_8mp_lf-5.10.y, rt-smarc-imx_4.1.15_1.0.0_ga, rt_linux_5.15.71, smarc-8m-android-11.0.0_2.0.0, smarc-imx6_4.14.98_2.0.0_ga, smarc-imx6_4.9.88_2.0.0_ga, smarc-imx7_4.14.98_2.0.0_ga, smarc-imx7_4.9.11_1.0.0_ga, smarc-imx7_4.9.88_2.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-imx_4.1.15_1.0.0_ga, smarc-imx_4.9.11_1.0.0_ga, smarc-imx_4.9.51_imx8m_ga, smarc-imx_4.9.88_2.0.0_ga, smarc-m6.0.1_2.1.0-ga, smarc-n7.1.2_2.0.0-ga, smarc-rel_imx_4.1.15_1.2.0_ga, smarc_8m_00d0_imx_4.14.98_2.0.0_ga, smarc_8m_imx_4.14.78_1.0.0_ga, smarc_8m_imx_4.14.98_2.0.0_ga, smarc_8m_imx_4.19.35_1.1.0, smarc_8mm_imx_4.14.78_1.0.0_ga, smarc_8mm_imx_4.14.98_2.0.0_ga, smarc_8mm_imx_4.19.35_1.1.0, smarc_8mm_imx_5.4.24_2.1.0, smarc_8mp_lf-5.10.y, smarc_8mq_imx_5.4.24_2.1.0, smarc_8mq_lf-5.10.y, smarc_imx_lf-5.15.y

rose: device refcount leak 

While hunting dev_put() for net-next-2.6, I found a device refcount
leak in ROSE, ioctl(SIOCADDRT) error path.

Fix is to not touch device refcount, as we hold RTNL

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Showing 1 changed file with 6 additions and 10 deletions Side-by-side Diff

net/rose/rose_route.c
Diff comments   View file @ b4ec824
... ... @@ -578,18 +578,18 @@
578 578  
579 579 /*
580 580 * Check that the device given is a valid AX.25 interface that is "up".
  581 + * called whith RTNL
581 582 */
582   -static struct net_device *rose_ax25_dev_get(char *devname)
  583 +static struct net_device *rose_ax25_dev_find(char *devname)
583 584 {
584 585 struct net_device *dev;
585 586  
586   - if ((dev = dev_get_by_name(&init_net, devname)) == NULL)
  587 + if ((dev = __dev_get_by_name(&init_net, devname)) == NULL)
587 588 return NULL;
588 589  
589 590 if ((dev->flags & IFF_UP) && dev->type == ARPHRD_AX25)
590 591 return dev;
591 592  
592   - dev_put(dev);
593 593 return NULL;
594 594 }
595 595  
596 596  
597 597  
598 598  
599 599  
600 600  
... ... @@ -720,27 +720,23 @@
720 720 case SIOCADDRT:
721 721 if (copy_from_user(&rose_route, arg, sizeof(struct rose_route_struct)))
722 722 return -EFAULT;
723   - if ((dev = rose_ax25_dev_get(rose_route.device)) == NULL)
  723 + if ((dev = rose_ax25_dev_find(rose_route.device)) == NULL)
724 724 return -EINVAL;
725   - if (rose_dev_exists(&rose_route.address)) { /* Can't add routes to ourself */
726   - dev_put(dev);
  725 + if (rose_dev_exists(&rose_route.address)) /* Can't add routes to ourself */
727 726 return -EINVAL;
728   - }
729 727 if (rose_route.mask > 10) /* Mask can't be more than 10 digits */
730 728 return -EINVAL;
731 729 if (rose_route.ndigis > AX25_MAX_DIGIS)
732 730 return -EINVAL;
733 731 err = rose_add_node(&rose_route, dev);
734   - dev_put(dev);
735 732 return err;
736 733  
737 734 case SIOCDELRT:
738 735 if (copy_from_user(&rose_route, arg, sizeof(struct rose_route_struct)))
739 736 return -EFAULT;
740   - if ((dev = rose_ax25_dev_get(rose_route.device)) == NULL)
  737 + if ((dev = rose_ax25_dev_find(rose_route.device)) == NULL)
741 738 return -EINVAL;
742 739 err = rose_del_node(&rose_route, dev);
743   - dev_put(dev);
744 740 return err;
745 741  
746 742 case SIOCRSCLRRT: