Commit fcfb894d authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

net: bridge: fix net device refcount tracking issue in error path 



I left one dev_put() in br_add_if() error path and sure enough
syzbot found its way.

As the tracker is allocated in new_nbp(), we must make sure
to properly free it.

We have to call dev_put_track(dev, &p->dev_tracker) before
@p object is freed, of course. This is not an issue because
br_add_if() owns a reference on @dev.

Fixes: b2dcdc7f ("net: bridge: add net device refcount tracker")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0bbed88a

net/bridge/br_if.c

+2 −1
Original line number Diff line number Diff line
@@ -615,6 +615,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev, 
	err = dev_set_allmulti(dev, 1);

	if (err) {

		br_multicast_del_port(p);

		dev_put_track(dev, &p->dev_tracker);

		kfree(p);	/* kobject not yet init'd, manually free */

		goto err1;

	}
@@ -724,10 +725,10 @@ int br_add_if(struct net_bridge *br, struct net_device *dev, 
	sysfs_remove_link(br->ifobj, p->dev->name);

err2:

	br_multicast_del_port(p);

	dev_put_track(dev, &p->dev_tracker);

	kobject_put(&p->kobj);

	dev_set_allmulti(dev, -1);

err1:

	dev_put(dev);

	return err;

}