Kernel/linux-next
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git synced 2025-01-16 13:34:30 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

dlci: acquire rtnl_lock before calling __dev_get_by_name()

Browse Source 
Otherwise the net device returned can be freed at anytime.

Signed-off-by: Li Zefan <lizefan@huawei.com>
Cc: stable@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Zefan Li 2013-06-26 15:29:54 +08:00 committed by David S. Miller
parent a5cc68f3d6
commit 11eb2645cb
1 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/net/wan/dlci.c
View File

@ -385,20 +385,24 @@ static int dlci_del(struct dlci_add *dlci)
struct net_device *master, *slave; struct net_device *master, *slave;
int err; int err;
rtnl_lock();
/* validate slave device */ /* validate slave device */
master = __dev_get_by_name(&init_net, dlci->devname); master = __dev_get_by_name(&init_net, dlci->devname);
if (!master) if (!master) {
return -ENODEV; err = -ENODEV;
goto out;
}
if (netif_running(master)) { if (netif_running(master)) {
return -EBUSY; err = -EBUSY;
goto out;
} }
dlp = netdev_priv(master); dlp = netdev_priv(master);
slave = dlp->slave; slave = dlp->slave;
flp = netdev_priv(slave); flp = netdev_priv(slave);
rtnl_lock();
err = (*flp->deassoc)(slave, master); err = (*flp->deassoc)(slave, master);
if (!err) { if (!err) {
list_del(&dlp->list); list_del(&dlp->list);
@ -407,8 +411,8 @@ static int dlci_del(struct dlci_add *dlci)
dev_put(slave); dev_put(slave);
} }
out:
rtnl_unlock(); rtnl_unlock();
return err; return err;
} }