Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
ppp: fix segfaults introduced by netdev_priv changes
net: Fix module refcount leak in kernel_accept()
+14
-17
+13
-15
drivers/net/ppp_generic.c
+13
-15
drivers/net/ppp_generic.c
···
116
116
unsigned long last_xmit; /* jiffies when last pkt sent 9c */
117
117
unsigned long last_recv; /* jiffies when last pkt rcvd a0 */
118
118
struct net_device *dev; /* network interface device a4 */
119
+
int closing; /* is device closing down? a8 */
119
120
#ifdef CONFIG_PPP_MULTILINK
120
121
int nxchan; /* next channel to send something on */
121
122
u32 nxseq; /* next sequence number to send */
···
996
995
struct sk_buff *skb;
997
996
998
997
ppp_xmit_lock(ppp);
999
-
if (ppp->dev) {
998
+
if (!ppp->closing) {
1000
999
ppp_push(ppp);
1001
1000
while (!ppp->xmit_pending
1002
1001
&& (skb = skb_dequeue(&ppp->file.xq)))
···
1464
1463
ppp_do_recv(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
1465
1464
{
1466
1465
ppp_recv_lock(ppp);
1467
-
/* ppp->dev == 0 means interface is closing down */
1468
-
if (ppp->dev)
1466
+
if (!ppp->closing)
1469
1467
ppp_receive_frame(ppp, skb, pch);
1470
1468
else
1471
1469
kfree_skb(skb);
···
2498
2498
*/
2499
2499
static void ppp_shutdown_interface(struct ppp *ppp)
2500
2500
{
2501
-
struct net_device *dev;
2502
-
2503
2501
mutex_lock(&all_ppp_mutex);
2504
-
ppp_lock(ppp);
2505
-
dev = ppp->dev;
2506
-
ppp->dev = NULL;
2507
-
ppp_unlock(ppp);
2508
2502
/* This will call dev_close() for us. */
2509
-
if (dev) {
2510
-
unregister_netdev(dev);
2511
-
free_netdev(dev);
2512
-
}
2503
+
ppp_lock(ppp);
2504
+
if (!ppp->closing) {
2505
+
ppp->closing = 1;
2506
+
ppp_unlock(ppp);
2507
+
unregister_netdev(ppp->dev);
2508
+
} else
2509
+
ppp_unlock(ppp);
2510
+
2513
2511
cardmap_set(&all_ppp_units, ppp->file.index, NULL);
2514
2512
ppp->file.dead = 1;
2515
2513
ppp->owner = NULL;
···
2552
2554
if (ppp->xmit_pending)
2553
2555
kfree_skb(ppp->xmit_pending);
2554
2556
2555
-
kfree(ppp);
2557
+
free_netdev(ppp->dev);
2556
2558
}
2557
2559
2558
2560
/*
···
2614
2616
if (pch->file.hdrlen > ppp->file.hdrlen)
2615
2617
ppp->file.hdrlen = pch->file.hdrlen;
2616
2618
hdrlen = pch->file.hdrlen + 2; /* for protocol bytes */
2617
-
if (ppp->dev && hdrlen > ppp->dev->hard_header_len)
2619
+
if (hdrlen > ppp->dev->hard_header_len)
2618
2620
ppp->dev->hard_header_len = hdrlen;
2619
2621
list_add_tail(&pch->clist, &ppp->channels);
2620
2622
++ppp->n_channels;
-2
net/bluetooth/rfcomm/core.c
-2
net/bluetooth/rfcomm/core.c