ipv6: Fix using after dev_put()
Wang Chen [Tue, 15 Jul 2008 03:54:54 +0000 (20:54 -0700)]
Patrick McHardy pointed it out.

Signed-off-by: Wang Chen <wangchen@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

net/ipv6/ip6mr.c

index 2dd8325..0b41aa2 100644 (file)
@@ -443,6 +443,7 @@ static struct net_device *ip6mr_reg_vif(void)
        if (dev_open(dev))
                goto failure;
 
+       dev_hold(dev);
        return dev;
 
 failure:
@@ -616,6 +617,7 @@ static int mif6_add(struct mif6ctl *vifc, int mrtsock)
                err = dev_set_allmulti(dev, 1);
                if (err) {
                        unregister_netdevice(dev);
+                       dev_put(dev);
                        return err;
                }
                break;
@@ -624,10 +626,11 @@ static int mif6_add(struct mif6ctl *vifc, int mrtsock)
                dev = dev_get_by_index(&init_net, vifc->mif6c_pifi);
                if (!dev)
                        return -EADDRNOTAVAIL;
-               dev_put(dev);
                err = dev_set_allmulti(dev, 1);
-               if (err)
+               if (err) {
+                       dev_put(dev);
                        return err;
+               }
                break;
        default:
                return -EINVAL;
@@ -651,7 +654,6 @@ static int mif6_add(struct mif6ctl *vifc, int mrtsock)
 
        /* And finish update writing critical data */
        write_lock_bh(&mrt_lock);
-       dev_hold(dev);
        v->dev = dev;
 #ifdef CONFIG_IPV6_PIMSM_V2
        if (v->flags & MIFF_REGISTER)