From: Wang Chen <wangchen@cn.fujitsu.com>
Date: Tue, 15 Jul 2008 03:54:54 +0000 (-0700)
Subject: ipv6: Fix using after dev_put()
X-Git-Tag: v2.6.27-rc1~969^2~154
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7af3db78a99f47b9ff40b8cb0bb08160ad6a3d6b;p=linux-2.6

ipv6: Fix using after dev_put()

Patrick McHardy pointed it out.

Signed-off-by: Wang Chen <wangchen@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 2dd832592a..0b41aa2675 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -443,6 +443,7 @@ static struct net_device *ip6mr_reg_vif(void)
 	if (dev_open(dev))
 		goto failure;
 
+	dev_hold(dev);
 	return dev;
 
 failure:
@@ -616,6 +617,7 @@ static int mif6_add(struct mif6ctl *vifc, int mrtsock)
 		err = dev_set_allmulti(dev, 1);
 		if (err) {
 			unregister_netdevice(dev);
+			dev_put(dev);
 			return err;
 		}
 		break;
@@ -624,10 +626,11 @@ static int mif6_add(struct mif6ctl *vifc, int mrtsock)
 		dev = dev_get_by_index(&init_net, vifc->mif6c_pifi);
 		if (!dev)
 			return -EADDRNOTAVAIL;
-		dev_put(dev);
 		err = dev_set_allmulti(dev, 1);
-		if (err)
+		if (err) {
+			dev_put(dev);
 			return err;
+		}
 		break;
 	default:
 		return -EINVAL;
@@ -651,7 +654,6 @@ static int mif6_add(struct mif6ctl *vifc, int mrtsock)
 
 	/* And finish update writing critical data */
 	write_lock_bh(&mrt_lock);
-	dev_hold(dev);
 	v->dev = dev;
 #ifdef CONFIG_IPV6_PIMSM_V2
 	if (v->flags & MIFF_REGISTER)