Commit e297db3e authored by Matt Johnston's avatar Matt Johnston Committed by David S. Miller
Browse files

mctp: Fix incorrect netdev unref for extended addr 



In the extended addressing local route output codepath
dev_get_by_index_rcu() doesn't take a dev_hold() so we shouldn't
dev_put().

Signed-off-by: default avatarMatt Johnston <matt@codeconstruct.com.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent dc121c00

net/mctp/route.c

+2 −6
Original line number Diff line number Diff line
@@ -838,7 +838,6 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt, 
	struct mctp_skb_cb *cb = mctp_cb(skb);

	struct mctp_route tmp_rt = {0};

	struct mctp_sk_key *key;

	struct net_device *dev;

	struct mctp_hdr *hdr;

	unsigned long flags;

	unsigned int mtu;
@@ -851,12 +850,12 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt, 


	if (rt) {

		ext_rt = false;

		dev = NULL;



		if (WARN_ON(!rt->dev))

			goto out_release;



	} else if (cb->ifindex) {

		struct net_device *dev;



		ext_rt = true;

		rt = &tmp_rt;
@@ -866,7 +865,6 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt, 
			rcu_read_unlock();

			return rc;

		}



		rt->dev = __mctp_dev_get(dev);

		rcu_read_unlock();
@@ -947,11 +945,9 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt, 
	if (!ext_rt)

		mctp_route_release(rt);



	dev_put(dev);

	mctp_dev_put(tmp_rt.dev);



	return rc;



}



/* route management */