Commit 36485707 authored Jun 05, 2006 by Jiri Benc Committed by David S. Miller Jun 05, 2006

[BRIDGE]: fix locking and memory leak in br_add_bridge



There are several bugs in error handling in br_add_bridge:
- when dev_alloc_name fails, allocated net_device is not freed
- unregister_netdev is called when rtnl lock is held
- free_netdev is called before netdev_run_todo has a chance to be run after
  unregistering net_device

Signed-off-by: Jiri Benc <jbenc@suse.cz>
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 8c893ff6

net/bridge/br_if.c

+7 −12

Original line number	Diff line number	Diff line
		@@ -300,25 +300,20 @@ int br_add_bridge(const char *name)
		rtnl_lock();
		if (strchr(dev->name, '%')) {
		ret = dev_alloc_name(dev, dev->name);
		if (ret < 0)
		goto err1;
		if (ret < 0) {
		free_netdev(dev);
		goto out;
		}
		}

		ret = register_netdevice(dev);
		if (ret)
		goto err2;
		goto out;

		ret = br_sysfs_addbr(dev);
		if (ret)
		goto err3;
		rtnl_unlock();
		return 0;

		err3:
		unregister_netdev(dev);
		err2:
		free_netdev(dev);
		err1:
		unregister_netdevice(dev);
		out:
		rtnl_unlock();
		return ret;
		}

Admin message