diff options
| author | Zhengchao Shao <shaozhengchao@huawei.com> | 2022-11-03 17:09:05 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-11-25 17:36:45 +0100 |
| commit | da3b101dc6189a4789d21705e757e975303233fc (patch) | |
| tree | 769a95ff52bda646b09f4786d7d1b7322bc6c961 | |
| parent | 813001253556dd9c08a6642e8844accd52d7b46d (diff) | |
| download | linux-stable-da3b101dc6189a4789d21705e757e975303233fc.tar.gz linux-stable-da3b101dc6189a4789d21705e757e975303233fc.tar.bz2 linux-stable-da3b101dc6189a4789d21705e757e975303233fc.zip | |
hamradio: fix issue of dev reference count leakage in bpq_device_event()
[ Upstream commit 85cbaf032d3cd9f595152625eda5d4ecb1d6d78d ]
When following tests are performed, it will cause dev reference counting
leakage.
a)ip link add bond2 type bond mode balance-rr
b)ip link set bond2 up
c)ifenslave -f bond2 rose1
d)ip link del bond2
When new bond device is created, the default type of the bond device is
ether. And the bond device is up, bpq_device_event() receives the message
and creates a new bpq device. In this case, the reference count value of
dev is hold once. But after "ifenslave -f bond2 rose1" command is
executed, the type of the bond device is changed to rose. When the bond
device is unregistered, bpq_device_event() will not put the dev reference
count.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/net/hamradio/bpqether.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c index 7d94a7842557..5044ef45afda 100644 --- a/drivers/net/hamradio/bpqether.c +++ b/drivers/net/hamradio/bpqether.c @@ -551,7 +551,7 @@ static int bpq_device_event(struct notifier_block *this, if (!net_eq(dev_net(dev), &init_net)) return NOTIFY_DONE; - if (!dev_is_ethdev(dev)) + if (!dev_is_ethdev(dev) && !bpq_get_ax25_dev(dev)) return NOTIFY_DONE; switch (event) { |