Commit a1badb57 authored by Jay Vosburgh's avatar Jay Vosburgh Committed by Sun Shouxin
Browse files

bonding: fix reference count leak in balance-alb mode 

mainline inclusion
from mainline-v6.0
commit 4f5d33f4
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I5UYT6
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/net/bonding/bond_alb.c?h=v6.0&id=4f5d33f4f798b1c6d92b613f0087f639d9836971



--------------------------------------------------------------------

Commit d5410ac7 ("net:bonding:support balance-alb interface
with vlan to bridge") introduced a reference count leak by not releasing
the reference acquired by ip_dev_find().  Remedy this by insuring the
reference is released.

Fixes: d5410ac7 ("net:bonding:support balance-alb interface with vlan to bridge")
Signed-off-by: default avatarJay Vosburgh <jay.vosburgh@canonical.com>
Reviewed-by: default avatarNikolay Aleksandrov <razor@blackwall.org>
Link: https://lore.kernel.org/r/26758.1660194413@famine


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarSun Shouxin <sunshouxin@chinatelecom.cn>
parent b0b03a7d

drivers/net/bonding/bond_alb.c

+4 −1
Original line number Diff line number Diff line
@@ -680,9 +680,12 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) 


	dev = ip_dev_find(dev_net(bond->dev), arp->ip_src);

	if (dev) {

		if (netif_is_bridge_master(dev))

		if (netif_is_bridge_master(dev)) {

			dev_put(dev);

			return NULL;

		}

		dev_put(dev);

	}



	if (arp->op_code == htons(ARPOP_REPLY)) {

		/* the arp must be sent on the selected rx channel */