dlci: acquire rtnl_lock before calling __dev_get_by_name()

Otherwise the net device returned can be freed at anytime.

Signed-off-by: Li Zefan <lizefan@huawei.com>
Cc: stable@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Zefan Li 2013-06-26 15:29:54 +08:00 committed by David S. Miller
parent a5cc68f3d6
commit 11eb2645cb

View File

@ -385,20 +385,24 @@ static int dlci_del(struct dlci_add *dlci)
struct net_device *master, *slave;
int err;
rtnl_lock();
/* validate slave device */
master = __dev_get_by_name(&init_net, dlci->devname);
if (!master)
return -ENODEV;
if (!master) {
err = -ENODEV;
goto out;
}
if (netif_running(master)) {
return -EBUSY;
err = -EBUSY;
goto out;
}
dlp = netdev_priv(master);
slave = dlp->slave;
flp = netdev_priv(slave);
rtnl_lock();
err = (*flp->deassoc)(slave, master);
if (!err) {
list_del(&dlp->list);
@ -407,8 +411,8 @@ static int dlci_del(struct dlci_add *dlci)
dev_put(slave);
}
out:
rtnl_unlock();
return err;
}