| From stable-bounces@linux.kernel.org Wed Jul 18 02:54:27 2007 |
| From: Satyam Sharma <ssatyam@cse.iitk.ac.in> |
| Date: Wed, 18 Jul 2007 02:54:19 -0700 (PDT) |
| Subject: Netpoll leak |
| To: stable@kernel.org |
| Cc: bunk@stusta.de |
| Message-ID: <20070718.025419.108809166.davem@davemloft.net> |
| |
| From: Satyam Sharma <ssatyam@cse.iitk.ac.in> |
| |
| [NETPOLL]: Fix a leak-n-bug in netpoll_cleanup() |
| |
| 93ec2c723e3f8a216dde2899aeb85c648672bc6b applied excessive duct tape to |
| the netpoll beast's netpoll_cleanup(), thus substituting one leak with |
| another, and opening up a little buglet :-) |
| |
| net_device->npinfo (netpoll_info) is a shared and refcounted object and |
| cannot simply be set NULL the first time netpoll_cleanup() is called. |
| Otherwise, further netpoll_cleanup()'s see np->dev->npinfo == NULL and |
| become no-ops, thus leaking. And it's a bug too: the first call to |
| netpoll_cleanup() would thus (annoyingly) "disable" other (still alive) |
| netpolls too. Maybe nobody noticed this because netconsole (only user |
| of netpoll) never supported multiple netpoll objects earlier. |
| |
| This is a trivial and obvious one-line fixlet. |
| |
| Signed-off-by: Satyam Sharma <ssatyam@cse.iitk.ac.in> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| net/core/netpoll.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/net/core/netpoll.c |
| +++ b/net/core/netpoll.c |
| @@ -781,7 +781,6 @@ void netpoll_cleanup(struct netpoll *np) |
| spin_unlock_irqrestore(&npinfo->rx_lock, flags); |
| } |
| |
| - np->dev->npinfo = NULL; |
| if (atomic_dec_and_test(&npinfo->refcnt)) { |
| skb_queue_purge(&npinfo->arp_tx); |
| skb_queue_purge(&npinfo->txq); |
| @@ -794,6 +793,7 @@ void netpoll_cleanup(struct netpoll *np) |
| kfree_skb(skb); |
| } |
| kfree(npinfo); |
| + np->dev->npinfo = NULL; |
| } |
| } |
| |