Author: marek Date: 2010-08-20 21:16:11 +0200 (Fri, 20 Aug 2010) New Revision: 1774
Modified: trunk/batman-adv/hard-interface.c Log: batman-adv: Don't use net_dev after dev_put
dev_put allows a device to be freed when all its references are dropped. After that we are not allowed to access that information anymore. Access to the data structure of a net_device must be surrounded a dev_hold and ended using dev_put.
batman-adv adds a device to its own management structure in hardif_add_interface and will release it in hardif_remove_interface. Thus it must hold a reference all the time between those functions to prevent any access to the already released net_device structure.
Reported-by: Tim Glaremin Tim.Glaremin@web.de Signed-off-by: Sven Eckelmann sven.eckelmann@gmx.de
Modified: trunk/batman-adv/hard-interface.c =================================================================== --- trunk/batman-adv/hard-interface.c 2010-08-20 19:16:09 UTC (rev 1773) +++ trunk/batman-adv/hard-interface.c 2010-08-20 19:16:11 UTC (rev 1774) @@ -214,7 +214,6 @@ return;
bat_priv = netdev_priv(batman_if->soft_iface); - dev_hold(batman_if->net_dev);
update_mac_addresses(batman_if); batman_if->if_status = IF_TO_BE_ACTIVATED; @@ -239,8 +238,6 @@ (batman_if->if_status != IF_TO_BE_ACTIVATED)) return;
- dev_put(batman_if->net_dev); - batman_if->if_status = IF_INACTIVE;
bat_info(batman_if->soft_iface, "Interface deactivated: %s\n", @@ -386,11 +383,13 @@ if (ret != 1) goto out;
+ dev_hold(net_dev); + batman_if = kmalloc(sizeof(struct batman_if), GFP_ATOMIC); if (!batman_if) { pr_err("Can't add interface (%s): out of memory\n", net_dev->name); - goto out; + goto release_dev; }
ret = sysfs_add_hardif(&batman_if->hardif_obj, net_dev); @@ -409,6 +408,8 @@
free_if: kfree(batman_if); +release_dev: + dev_put(net_dev); out: return NULL; } @@ -432,6 +433,7 @@ batman_if->if_status = IF_TO_BE_REMOVED; list_del_rcu(&batman_if->list); sysfs_del_hardif(&batman_if->hardif_obj); + dev_put(batman_if->net_dev); call_rcu(&batman_if->rcu, hardif_free_interface); }