diff options
author | Eric Dumazet <edumazet@google.com> | 2021-03-29 12:25:22 -0700 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-05-22 11:38:30 +0200 |
commit | f5ddecb6a19558f704230f27a822264268d97665 (patch) | |
tree | cb7fafd937e57fae46ac21d1b23910b03ff4de68 | |
parent | cca2a2b340a9b9e328f4d308b8a5f22164f4f718 (diff) | |
download | linux-stable-f5ddecb6a19558f704230f27a822264268d97665.tar.gz linux-stable-f5ddecb6a19558f704230f27a822264268d97665.tar.bz2 linux-stable-f5ddecb6a19558f704230f27a822264268d97665.zip |
sit: proper dev_{hold|put} in ndo_[un]init methods
commit 6289a98f0817a4a457750d6345e754838eae9439 upstream.
After adopting CONFIG_PCPU_DEV_REFCNT=n option, syzbot was able to trigger
a warning [1]
Issue here is that:
- all dev_put() should be paired with a corresponding prior dev_hold().
- A driver doing a dev_put() in its ndo_uninit() MUST also
do a dev_hold() in its ndo_init(), only when ndo_init()
is returning 0.
Otherwise, register_netdevice() would call ndo_uninit()
in its error path and release a refcount too soon.
Fixes: 919067cc845f ("net: add CONFIG_PCPU_DEV_REFCNT")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r-- | net/ipv6/sit.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c index 2710f3bc856f..64ce4cf62d25 100644 --- a/net/ipv6/sit.c +++ b/net/ipv6/sit.c @@ -211,8 +211,6 @@ static int ipip6_tunnel_create(struct net_device *dev) ipip6_tunnel_clone_6rd(dev, sitn); - dev_hold(dev); - ipip6_tunnel_link(sitn, t); return 0; @@ -1408,7 +1406,7 @@ static int ipip6_tunnel_init(struct net_device *dev) dev->tstats = NULL; return err; } - + dev_hold(dev); return 0; } |