Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-09 14:43:16 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

rose: device refcount leak

Browse Source 
While hunting dev_put() for net-next-2.6, I found a device refcount
leak in ROSE, ioctl(SIOCADDRT) error path.

Fix is to not touch device refcount, as we hold RTNL

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Eric Dumazet 2009-11-05 20:56:07 -08:00 committed by David S. Miller
parent 1056bd5167
commit b4ec824021
1 changed files with 6 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
net/rose/rose_route.c
View File

@ -578,18 +578,18 @@ static int rose_clear_routes(void)
/* /*
* Check that the device given is a valid AX.25 interface that is "up". * Check that the device given is a valid AX.25 interface that is "up".
* called whith RTNL
*/ */
static struct net_device *rose_ax25_dev_get(char *devname) static struct net_device *rose_ax25_dev_find(char *devname)
{ {
struct net_device *dev; struct net_device *dev;
if ((dev = dev_get_by_name(&init_net, devname)) == NULL) if ((dev = __dev_get_by_name(&init_net, devname)) == NULL)
return NULL; return NULL;
if ((dev->flags & IFF_UP) && dev->type == ARPHRD_AX25) if ((dev->flags & IFF_UP) && dev->type == ARPHRD_AX25)
return dev; return dev;
dev_put(dev);
return NULL; return NULL;
} }
@ -720,27 +720,23 @@ int rose_rt_ioctl(unsigned int cmd, void __user *arg)
case SIOCADDRT: case SIOCADDRT:
if (copy_from_user(&rose_route, arg, sizeof(struct rose_route_struct))) if (copy_from_user(&rose_route, arg, sizeof(struct rose_route_struct)))
return -EFAULT; return -EFAULT;
if ((dev = rose_ax25_dev_get(rose_route.device)) == NULL) if ((dev = rose_ax25_dev_find(rose_route.device)) == NULL)
return -EINVAL; return -EINVAL;
if (rose_dev_exists(&rose_route.address)) { /* Can't add routes to ourself */ if (rose_dev_exists(&rose_route.address)) /* Can't add routes to ourself */
dev_put(dev);
return -EINVAL; return -EINVAL;
}
if (rose_route.mask > 10) /* Mask can't be more than 10 digits */ if (rose_route.mask > 10) /* Mask can't be more than 10 digits */
return -EINVAL; return -EINVAL;
if (rose_route.ndigis > AX25_MAX_DIGIS) if (rose_route.ndigis > AX25_MAX_DIGIS)
return -EINVAL; return -EINVAL;
err = rose_add_node(&rose_route, dev); err = rose_add_node(&rose_route, dev);
dev_put(dev);
return err; return err;
case SIOCDELRT: case SIOCDELRT:
if (copy_from_user(&rose_route, arg, sizeof(struct rose_route_struct))) if (copy_from_user(&rose_route, arg, sizeof(struct rose_route_struct)))
return -EFAULT; return -EFAULT;
if ((dev = rose_ax25_dev_get(rose_route.device)) == NULL) if ((dev = rose_ax25_dev_find(rose_route.device)) == NULL)
return -EINVAL; return -EINVAL;
err = rose_del_node(&rose_route, dev); err = rose_del_node(&rose_route, dev);
dev_put(dev);
return err; return err;
case SIOCRSCLRRT: case SIOCRSCLRRT: