Commit 7ef5f41c authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  ppp: fix segfaults introduced by netdev_priv changes
  net: Fix module refcount leak in kernel_accept()
parents 3d44cc3e 739840d5

drivers/net/ppp_generic.c

+13 −15
Original line number Diff line number Diff line
@@ -116,6 +116,7 @@ struct ppp { 
	unsigned long	last_xmit;	/* jiffies when last pkt sent 9c */

	unsigned long	last_recv;	/* jiffies when last pkt rcvd a0 */

	struct net_device *dev;		/* network interface device a4 */

	int		closing;	/* is device closing down? a8 */

#ifdef CONFIG_PPP_MULTILINK

	int		nxchan;		/* next channel to send something on */

	u32		nxseq;		/* next sequence number to send */
@@ -995,7 +996,7 @@ ppp_xmit_process(struct ppp *ppp) 
	struct sk_buff *skb;



	ppp_xmit_lock(ppp);

	if (ppp->dev) {

	if (!ppp->closing) {

		ppp_push(ppp);

		while (!ppp->xmit_pending

		       && (skb = skb_dequeue(&ppp->file.xq)))
@@ -1463,8 +1464,7 @@ static inline void 
ppp_do_recv(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)

{

	ppp_recv_lock(ppp);

	/* ppp->dev == 0 means interface is closing down */

	if (ppp->dev)

	if (!ppp->closing)

		ppp_receive_frame(ppp, skb, pch);

	else

		kfree_skb(skb);
@@ -2498,18 +2498,16 @@ init_ppp_file(struct ppp_file *pf, int kind) 
 */

static void ppp_shutdown_interface(struct ppp *ppp)

{

	struct net_device *dev;



	mutex_lock(&all_ppp_mutex);

	/* This will call dev_close() for us. */

	ppp_lock(ppp);

	dev = ppp->dev;

	ppp->dev = NULL;

	if (!ppp->closing) {

		ppp->closing = 1;

		ppp_unlock(ppp);

	/* This will call dev_close() for us. */

	if (dev) {

		unregister_netdev(dev);

		free_netdev(dev);

	}

		unregister_netdev(ppp->dev);

	} else

		ppp_unlock(ppp);



	cardmap_set(&all_ppp_units, ppp->file.index, NULL);

	ppp->file.dead = 1;

	ppp->owner = NULL;
@@ -2554,7 +2552,7 @@ static void ppp_destroy_interface(struct ppp *ppp) 
	if (ppp->xmit_pending)

		kfree_skb(ppp->xmit_pending);



	kfree(ppp);

	free_netdev(ppp->dev);

}



/*
@@ -2616,7 +2614,7 @@ ppp_connect_channel(struct channel *pch, int unit) 
	if (pch->file.hdrlen > ppp->file.hdrlen)

		ppp->file.hdrlen = pch->file.hdrlen;

	hdrlen = pch->file.hdrlen + 2;	/* for protocol bytes */

	if (ppp->dev && hdrlen > ppp->dev->hard_header_len)

	if (hdrlen > ppp->dev->hard_header_len)

		ppp->dev->hard_header_len = hdrlen;

	list_add_tail(&pch->clist, &ppp->channels);

	++ppp->n_channels;

net/bluetooth/rfcomm/core.c

+0 −2
Original line number Diff line number Diff line
@@ -1786,8 +1786,6 @@ static inline void rfcomm_accept_connection(struct rfcomm_session *s) 
	if (err < 0)

		return;



	__module_get(nsock->ops->owner);



	/* Set our callbacks */

	nsock->sk->sk_data_ready   = rfcomm_l2data_ready;

	nsock->sk->sk_state_change = rfcomm_l2state_change;

net/socket.c

+1 −0
Original line number Diff line number Diff line
@@ -2307,6 +2307,7 @@ int kernel_accept(struct socket *sock, struct socket **newsock, int flags) 
	}



	(*newsock)->ops = sock->ops;

	__module_get((*newsock)->ops->owner);



done:

	return err;