Commit e297db3e authored by Matt Johnston's avatar Matt Johnston Committed by David S. Miller

mctp: Fix incorrect netdev unref for extended addr

In the extended addressing local route output codepath
dev_get_by_index_rcu() doesn't take a dev_hold() so we shouldn't
dev_put().
Signed-off-by: default avatarMatt Johnston <matt@codeconstruct.com.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent dc121c00
...@@ -838,7 +838,6 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt, ...@@ -838,7 +838,6 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt,
struct mctp_skb_cb *cb = mctp_cb(skb); struct mctp_skb_cb *cb = mctp_cb(skb);
struct mctp_route tmp_rt = {0}; struct mctp_route tmp_rt = {0};
struct mctp_sk_key *key; struct mctp_sk_key *key;
struct net_device *dev;
struct mctp_hdr *hdr; struct mctp_hdr *hdr;
unsigned long flags; unsigned long flags;
unsigned int mtu; unsigned int mtu;
...@@ -851,12 +850,12 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt, ...@@ -851,12 +850,12 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt,
if (rt) { if (rt) {
ext_rt = false; ext_rt = false;
dev = NULL;
if (WARN_ON(!rt->dev)) if (WARN_ON(!rt->dev))
goto out_release; goto out_release;
} else if (cb->ifindex) { } else if (cb->ifindex) {
struct net_device *dev;
ext_rt = true; ext_rt = true;
rt = &tmp_rt; rt = &tmp_rt;
...@@ -866,7 +865,6 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt, ...@@ -866,7 +865,6 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt,
rcu_read_unlock(); rcu_read_unlock();
return rc; return rc;
} }
rt->dev = __mctp_dev_get(dev); rt->dev = __mctp_dev_get(dev);
rcu_read_unlock(); rcu_read_unlock();
...@@ -947,11 +945,9 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt, ...@@ -947,11 +945,9 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt,
if (!ext_rt) if (!ext_rt)
mctp_route_release(rt); mctp_route_release(rt);
dev_put(dev);
mctp_dev_put(tmp_rt.dev); mctp_dev_put(tmp_rt.dev);
return rc; return rc;
} }
/* route management */ /* route management */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment