aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorDavid S. Miller <davem@davemloft.net>2011-02-08 14:31:31 -0800
committerDavid S. Miller <davem@davemloft.net>2011-02-08 14:31:31 -0800
commitb2df5a8446e135f7648736b8bec8179c88ce360d (patch)
tree472726c88dfd5a20c913bf557e4d6b5889e00510 /net
parent84e77a8bc73cad2f910cc981f266904c66a17825 (diff)
downloadkernel_samsung_espresso10-b2df5a8446e135f7648736b8bec8179c88ce360d.zip
kernel_samsung_espresso10-b2df5a8446e135f7648736b8bec8179c88ce360d.tar.gz
kernel_samsung_espresso10-b2df5a8446e135f7648736b8bec8179c88ce360d.tar.bz2
net/caif: Fix dangling list pointer in freed object on error.
rtnl_link_ops->setup(), and the "setup" callback passed to alloc_netdev*(), cannot make state changes which need to be undone on failure. There is no cleanup mechanism available at this point. So we have to add the caif private instance to the global list once we are sure that register_netdev() has succedded in ->newlink(). Otherwise, if register_netdev() fails, the caller will invoke free_netdev() and we will have a reference to freed up memory on the chnl_net_list. Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/caif/chnl_net.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
index fa9dab3..6008d6d 100644
--- a/net/caif/chnl_net.c
+++ b/net/caif/chnl_net.c
@@ -394,9 +394,7 @@ static void ipcaif_net_setup(struct net_device *dev)
priv->conn_req.sockaddr.u.dgm.connection_id = -1;
priv->flowenabled = false;
- ASSERT_RTNL();
init_waitqueue_head(&priv->netmgmt_wq);
- list_add(&priv->list_field, &chnl_net_list);
}
@@ -453,6 +451,8 @@ static int ipcaif_newlink(struct net *src_net, struct net_device *dev,
ret = register_netdevice(dev);
if (ret)
pr_warn("device rtml registration failed\n");
+ else
+ list_add(&caifdev->list_field, &chnl_net_list);
return ret;
}