Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 11eb2645 authored by Zefan Li's avatar Zefan Li Committed by David S. Miller
Browse files

dlci: acquire rtnl_lock before calling __dev_get_by_name() 



Otherwise the net device returned can be freed at anytime.

Signed-off-by: default avatarLi Zefan <lizefan@huawei.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent a5cc68f3

drivers/net/wan/dlci.c

+9 −5
Original line number Diff line number Diff line
@@ -385,20 +385,24 @@ static int dlci_del(struct dlci_add *dlci) 
	struct net_device	*master, *slave;

	int			err;



	rtnl_lock();



	/* validate slave device */

	master = __dev_get_by_name(&init_net, dlci->devname);

	if (!master)

		return -ENODEV;

	if (!master) {

		err = -ENODEV;

		goto out;

	}



	if (netif_running(master)) {

		return -EBUSY;

		err = -EBUSY;

		goto out;

	}



	dlp = netdev_priv(master);

	slave = dlp->slave;

	flp = netdev_priv(slave);



	rtnl_lock();

	err = (*flp->deassoc)(slave, master);

	if (!err) {

		list_del(&dlp->list);
@@ -407,8 +411,8 @@ static int dlci_del(struct dlci_add *dlci) 


		dev_put(slave);

	}

out:

	rtnl_unlock();



	return err;

}