hamradio: fix issue of dev reference count leakage in bpq_device_event()
authorZhengchao Shao <shaozhengchao@huawei.com>
Thu, 3 Nov 2022 09:09:05 +0000 (17:09 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 25 Nov 2022 16:35:35 +0000 (17:35 +0100)
commit0bb5d753c06a782a0a79cf3b570ec6cd6c47b5bf
tree72e9e8886aa05758af31de6fd621874390b6b47b
parent8747ea2c998b66c3fff68dbd0cb702d869d363bf
hamradio: fix issue of dev reference count leakage in bpq_device_event()

[ Upstream commit 85cbaf032d3cd9f595152625eda5d4ecb1d6d78d ]

When following tests are performed, it will cause dev reference counting
leakage.
a)ip link add bond2 type bond mode balance-rr
b)ip link set bond2 up
c)ifenslave -f bond2 rose1
d)ip link del bond2

When new bond device is created, the default type of the bond device is
ether. And the bond device is up, bpq_device_event() receives the message
and creates a new bpq device. In this case, the reference count value of
dev is hold once. But after "ifenslave -f bond2 rose1" command is
executed, the type of the bond device is changed to rose. When the bond
device is unregistered, bpq_device_event() will not put the dev reference
count.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/hamradio/bpqether.c