Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 543e3a8d authored by Bjorn Helgaas's avatar Bjorn Helgaas Committed by David S. Miller
Browse files

netpoll: Fix extra refcount release in netpoll_cleanup() 



netpoll_setup() does a dev_hold() on np->dev, the netpoll device.  If it
fails, it correctly does a dev_put() but leaves np->dev set.  If we call
netpoll_cleanup() after the failure, np->dev is still set so we do another
dev_put(), which decrements the refcount an extra time.

It's questionable to call netpoll_cleanup() after netpoll_setup() fails,
but it can be difficult to find the problem, and we can easily avoid it in
this case.  The extra decrements can lead to hangs like this:

  unregister_netdevice: waiting for bond0 to become free. Usage count = -3

Set and clear np->dev at the points where we dev_hold() and dev_put() the
device.

Signed-off-by: default avatarBjorn Helgaas <bhelgaas@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7dd39913

net/core/netpoll.c

+2 −1
Original line number Original line Diff line number Diff line
@@ -603,7 +603,6 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev) 
	const struct net_device_ops *ops;

	const struct net_device_ops *ops;

	int err;

	int err;





	np->dev = ndev;

	strlcpy(np->dev_name, ndev->name, IFNAMSIZ);

	strlcpy(np->dev_name, ndev->name, IFNAMSIZ);

	INIT_WORK(&np->cleanup_work, netpoll_async_cleanup);

	INIT_WORK(&np->cleanup_work, netpoll_async_cleanup);
@@ -670,6 +669,7 @@ int netpoll_setup(struct netpoll *np) 
		goto unlock;

		goto unlock;

	}

	}

	dev_hold(ndev);

	dev_hold(ndev);

	np->dev = ndev;





	if (netdev_master_upper_dev_get(ndev)) {

	if (netdev_master_upper_dev_get(ndev)) {

		np_err(np, "%s is a slave device, aborting\n", np->dev_name);

		np_err(np, "%s is a slave device, aborting\n", np->dev_name);
@@ -770,6 +770,7 @@ int netpoll_setup(struct netpoll *np) 
	return 0;

	return 0;





put:

put:

	np->dev = NULL;

	dev_put(ndev);

	dev_put(ndev);

unlock:

unlock:

	rtnl_unlock();

	rtnl_unlock();