diff options
| author | David S. Miller <davem@davemloft.net> | 2011-02-08 14:31:31 -0800 |
|---|---|---|
| committer | Jonas ABERG <jonas.aberg@stericsson.com> | 2011-04-26 08:29:49 +0200 |
| commit | 309c53c019614856a14e21611863612a3718ef6a (patch) | |
| tree | 0df339faa493fc1d6de9da429cf697ce2e757692 /net | |
| parent | e422d3e870d8a560e89a5a6768601a7c40d343cd (diff) | |
net/caif: Fix dangling list pointer in freed object on error.
rtnl_link_ops->setup(), and the "setup" callback passed to alloc_netdev*(),
cannot make state changes which need to be undone on failure. There is
no cleanup mechanism available at this point.
So we have to add the caif private instance to the global list once we
are sure that register_netdev() has succedded in ->newlink().
Otherwise, if register_netdev() fails, the caller will invoke free_netdev()
and we will have a reference to freed up memory on the chnl_net_list.
Signed-off-by: David S. Miller <davem@davemloft.net>
Change-Id: I9107d9bc35363f215c562bfdbc54724178929b5d
Reviewed-on: http://gerrit.lud.stericsson.com/gerrit/21519
Reviewed-by: Erwan BRACQ <erwan.bracq@stericsson.com>
Tested-by: Erwan BRACQ <erwan.bracq@stericsson.com>
Reviewed-by: QATEST
Reviewed-by: Jonas ABERG <jonas.aberg@stericsson.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/caif/chnl_net.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c index fa9dab372b6..6008d6dc18a 100644 --- a/net/caif/chnl_net.c +++ b/net/caif/chnl_net.c @@ -394,9 +394,7 @@ static void ipcaif_net_setup(struct net_device *dev) priv->conn_req.sockaddr.u.dgm.connection_id = -1; priv->flowenabled = false; - ASSERT_RTNL(); init_waitqueue_head(&priv->netmgmt_wq); - list_add(&priv->list_field, &chnl_net_list); } @@ -453,6 +451,8 @@ static int ipcaif_newlink(struct net *src_net, struct net_device *dev, ret = register_netdevice(dev); if (ret) pr_warn("device rtml registration failed\n"); + else + list_add(&caifdev->list_field, &chnl_net_list); return ret; } |