Commit 7ef5f41c authored by Linus Torvalds's avatar Linus Torvalds

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  ppp: fix segfaults introduced by netdev_priv changes
  net: Fix module refcount leak in kernel_accept()
parents 3d44cc3e 739840d5
...@@ -116,6 +116,7 @@ struct ppp { ...@@ -116,6 +116,7 @@ struct ppp {
unsigned long last_xmit; /* jiffies when last pkt sent 9c */ unsigned long last_xmit; /* jiffies when last pkt sent 9c */
unsigned long last_recv; /* jiffies when last pkt rcvd a0 */ unsigned long last_recv; /* jiffies when last pkt rcvd a0 */
struct net_device *dev; /* network interface device a4 */ struct net_device *dev; /* network interface device a4 */
int closing; /* is device closing down? a8 */
#ifdef CONFIG_PPP_MULTILINK #ifdef CONFIG_PPP_MULTILINK
int nxchan; /* next channel to send something on */ int nxchan; /* next channel to send something on */
u32 nxseq; /* next sequence number to send */ u32 nxseq; /* next sequence number to send */
...@@ -995,7 +996,7 @@ ppp_xmit_process(struct ppp *ppp) ...@@ -995,7 +996,7 @@ ppp_xmit_process(struct ppp *ppp)
struct sk_buff *skb; struct sk_buff *skb;
ppp_xmit_lock(ppp); ppp_xmit_lock(ppp);
if (ppp->dev) { if (!ppp->closing) {
ppp_push(ppp); ppp_push(ppp);
while (!ppp->xmit_pending while (!ppp->xmit_pending
&& (skb = skb_dequeue(&ppp->file.xq))) && (skb = skb_dequeue(&ppp->file.xq)))
...@@ -1463,8 +1464,7 @@ static inline void ...@@ -1463,8 +1464,7 @@ static inline void
ppp_do_recv(struct ppp *ppp, struct sk_buff *skb, struct channel *pch) ppp_do_recv(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
{ {
ppp_recv_lock(ppp); ppp_recv_lock(ppp);
/* ppp->dev == 0 means interface is closing down */ if (!ppp->closing)
if (ppp->dev)
ppp_receive_frame(ppp, skb, pch); ppp_receive_frame(ppp, skb, pch);
else else
kfree_skb(skb); kfree_skb(skb);
...@@ -2498,18 +2498,16 @@ init_ppp_file(struct ppp_file *pf, int kind) ...@@ -2498,18 +2498,16 @@ init_ppp_file(struct ppp_file *pf, int kind)
*/ */
static void ppp_shutdown_interface(struct ppp *ppp) static void ppp_shutdown_interface(struct ppp *ppp)
{ {
struct net_device *dev;
mutex_lock(&all_ppp_mutex); mutex_lock(&all_ppp_mutex);
/* This will call dev_close() for us. */
ppp_lock(ppp); ppp_lock(ppp);
dev = ppp->dev; if (!ppp->closing) {
ppp->dev = NULL; ppp->closing = 1;
ppp_unlock(ppp); ppp_unlock(ppp);
/* This will call dev_close() for us. */ unregister_netdev(ppp->dev);
if (dev) { } else
unregister_netdev(dev); ppp_unlock(ppp);
free_netdev(dev);
}
cardmap_set(&all_ppp_units, ppp->file.index, NULL); cardmap_set(&all_ppp_units, ppp->file.index, NULL);
ppp->file.dead = 1; ppp->file.dead = 1;
ppp->owner = NULL; ppp->owner = NULL;
...@@ -2554,7 +2552,7 @@ static void ppp_destroy_interface(struct ppp *ppp) ...@@ -2554,7 +2552,7 @@ static void ppp_destroy_interface(struct ppp *ppp)
if (ppp->xmit_pending) if (ppp->xmit_pending)
kfree_skb(ppp->xmit_pending); kfree_skb(ppp->xmit_pending);
kfree(ppp); free_netdev(ppp->dev);
} }
/* /*
...@@ -2616,7 +2614,7 @@ ppp_connect_channel(struct channel *pch, int unit) ...@@ -2616,7 +2614,7 @@ ppp_connect_channel(struct channel *pch, int unit)
if (pch->file.hdrlen > ppp->file.hdrlen) if (pch->file.hdrlen > ppp->file.hdrlen)
ppp->file.hdrlen = pch->file.hdrlen; ppp->file.hdrlen = pch->file.hdrlen;
hdrlen = pch->file.hdrlen + 2; /* for protocol bytes */ hdrlen = pch->file.hdrlen + 2; /* for protocol bytes */
if (ppp->dev && hdrlen > ppp->dev->hard_header_len) if (hdrlen > ppp->dev->hard_header_len)
ppp->dev->hard_header_len = hdrlen; ppp->dev->hard_header_len = hdrlen;
list_add_tail(&pch->clist, &ppp->channels); list_add_tail(&pch->clist, &ppp->channels);
++ppp->n_channels; ++ppp->n_channels;
......
...@@ -1786,8 +1786,6 @@ static inline void rfcomm_accept_connection(struct rfcomm_session *s) ...@@ -1786,8 +1786,6 @@ static inline void rfcomm_accept_connection(struct rfcomm_session *s)
if (err < 0) if (err < 0)
return; return;
__module_get(nsock->ops->owner);
/* Set our callbacks */ /* Set our callbacks */
nsock->sk->sk_data_ready = rfcomm_l2data_ready; nsock->sk->sk_data_ready = rfcomm_l2data_ready;
nsock->sk->sk_state_change = rfcomm_l2state_change; nsock->sk->sk_state_change = rfcomm_l2state_change;
......
...@@ -2307,6 +2307,7 @@ int kernel_accept(struct socket *sock, struct socket **newsock, int flags) ...@@ -2307,6 +2307,7 @@ int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
} }
(*newsock)->ops = sock->ops; (*newsock)->ops = sock->ops;
__module_get((*newsock)->ops->owner);
done: done:
return err; return err;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment