Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 36485707 authored by Jiri Benc's avatar Jiri Benc Committed by David S. Miller
Browse files

[BRIDGE]: fix locking and memory leak in br_add_bridge 



There are several bugs in error handling in br_add_bridge:
- when dev_alloc_name fails, allocated net_device is not freed
- unregister_netdev is called when rtnl lock is held
- free_netdev is called before netdev_run_todo has a chance to be run after
  unregistering net_device

Signed-off-by: default avatarJiri Benc <jbenc@suse.cz>
Signed-off-by: default avatarStephen Hemminger <shemminger@osdl.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8c893ff6

net/bridge/br_if.c

+7 −12
Original line number Original line Diff line number Diff line
@@ -300,25 +300,20 @@ int br_add_bridge(const char *name) 
	rtnl_lock();

	rtnl_lock();

	if (strchr(dev->name, '%')) {

	if (strchr(dev->name, '%')) {

		ret = dev_alloc_name(dev, dev->name);

		ret = dev_alloc_name(dev, dev->name);

		if (ret < 0)

		if (ret < 0) {

			goto err1;

			free_netdev(dev);

			goto out;

		}

	}

	}





	ret = register_netdevice(dev);

	ret = register_netdevice(dev);

	if (ret)

	if (ret)

		goto err2;

		goto out;





	ret = br_sysfs_addbr(dev);

	ret = br_sysfs_addbr(dev);

	if (ret)

	if (ret)

		goto err3;

		unregister_netdevice(dev);

	rtnl_unlock();

 out:

	return 0;



 err3:

	unregister_netdev(dev);

 err2:

	free_netdev(dev);

 err1:

	rtnl_unlock();

	rtnl_unlock();

	return ret;

	return ret;

}

}