There are several bugs in error handling in br_add_bridge:
- when dev_alloc_name fails, allocated net_device is not freed
- unregister_netdev is called when rtnl lock is held
- free_netdev is called before netdev_run_todo has a chance to be run after
  unregistering net_device

This patch should fix these issues.
Minor rearrangement of to use common path of earlier patch. Dave please apply.

Signed-off-by: Jiri Benc <[EMAIL PROTECTED]>
Signed-off-by: Stephen Hemminger <[EMAIL PROTECTED]>

--- br.orig/net/bridge/br_if.c
+++ br/net/bridge/br_if.c
@@ -301,25 +301,20 @@ int br_add_bridge(const char *name)
        if (strchr(dev->name, '%')) {
                ret = dev_alloc_name(dev, dev->name);
                if (ret < 0)
-                       goto err1;
+                       goto err;
        }
 
        ret = register_netdevice(dev);
        if (ret)
-               goto err2;
+               goto err;
 
        ret = br_sysfs_addbr(dev);
        if (ret)
-               goto err3;
-       rtnl_unlock();
-       return 0;
-
- err3:
-       unregister_netdev(dev);
- err2:
-       free_netdev(dev);
- err1:
+               unregister_netdevice(dev);
+ err:
        rtnl_unlock();
+       if (ret)
+               free_netdev(dev);
        return ret;
 }
 
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to