| From a8450dc36241a24946e108e79f691c4e4630accf Mon Sep 17 00:00:00 2001 |
| From: Gao feng <gaofeng@cn.fujitsu.com> |
| Date: Wed, 24 Apr 2013 21:59:23 +0000 |
| Subject: net: tun: release the reference of tun device in tun_recvmsg |
| |
| |
| From: Gao feng <gaofeng@cn.fujitsu.com> |
| |
| [ Upstream commit 3811ae76bc84e5dc1a670ae10695f046b310bee1 ] |
| |
| We forget to release the reference of tun device in tun_recvmsg. |
| bug introduced in commit 54f968d6efdbf7dec36faa44fc11f01b0e4d1990 |
| (tuntap: move socket to tun_file) |
| |
| Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> |
| Acked-by: Jason Wang <jasowang@redhat.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/tun.c | 7 +++++-- |
| 1 file changed, 5 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/net/tun.c |
| +++ b/drivers/net/tun.c |
| @@ -1471,14 +1471,17 @@ static int tun_recvmsg(struct kiocb *ioc |
| if (!tun) |
| return -EBADFD; |
| |
| - if (flags & ~(MSG_DONTWAIT|MSG_TRUNC)) |
| - return -EINVAL; |
| + if (flags & ~(MSG_DONTWAIT|MSG_TRUNC)) { |
| + ret = -EINVAL; |
| + goto out; |
| + } |
| ret = tun_do_read(tun, tfile, iocb, m->msg_iov, total_len, |
| flags & MSG_DONTWAIT); |
| if (ret > total_len) { |
| m->msg_flags |= MSG_TRUNC; |
| ret = flags & MSG_TRUNC ? ret : total_len; |
| } |
| +out: |
| tun_put(tun); |
| return ret; |
| } |
