Commit 2f599ec4 authored by Michal Kubecek's avatar Michal Kubecek Committed by David S. Miller

ethtool: fix reference leak in some *_SET handlers

Andrew noticed that some handlers for *_SET commands leak a netdev
reference if required ethtool_ops callbacks do not exist. A simple
reproducer would be e.g.

  ip link add veth1 type veth peer name veth2
  ethtool -s veth1 wol g
  ip link del veth1

Make sure dev_put() is called when ethtool_ops check fails.

v2: add Fixes tags

Fixes: a53f3d41 ("ethtool: set link settings with LINKINFO_SET request")
Fixes: bfbcfe20 ("ethtool: set link modes related data with LINKMODES_SET request")
Fixes: e54d04e3 ("ethtool: set message mask with DEBUG_SET request")
Fixes: 8d425b19 ("ethtool: set wake-on-lan settings with WOL_SET request")
Reported-by: default avatarAndrew Lunn <andrew@lunn.ch>
Signed-off-by: default avatarMichal Kubecek <mkubecek@suse.cz>
Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
Reviewed-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0e62f543
...@@ -107,8 +107,9 @@ int ethnl_set_debug(struct sk_buff *skb, struct genl_info *info) ...@@ -107,8 +107,9 @@ int ethnl_set_debug(struct sk_buff *skb, struct genl_info *info)
if (ret < 0) if (ret < 0)
return ret; return ret;
dev = req_info.dev; dev = req_info.dev;
ret = -EOPNOTSUPP;
if (!dev->ethtool_ops->get_msglevel || !dev->ethtool_ops->set_msglevel) if (!dev->ethtool_ops->get_msglevel || !dev->ethtool_ops->set_msglevel)
return -EOPNOTSUPP; goto out_dev;
rtnl_lock(); rtnl_lock();
ret = ethnl_ops_begin(dev); ret = ethnl_ops_begin(dev);
...@@ -129,6 +130,7 @@ int ethnl_set_debug(struct sk_buff *skb, struct genl_info *info) ...@@ -129,6 +130,7 @@ int ethnl_set_debug(struct sk_buff *skb, struct genl_info *info)
ethnl_ops_complete(dev); ethnl_ops_complete(dev);
out_rtnl: out_rtnl:
rtnl_unlock(); rtnl_unlock();
out_dev:
dev_put(dev); dev_put(dev);
return ret; return ret;
} }
...@@ -126,9 +126,10 @@ int ethnl_set_linkinfo(struct sk_buff *skb, struct genl_info *info) ...@@ -126,9 +126,10 @@ int ethnl_set_linkinfo(struct sk_buff *skb, struct genl_info *info)
if (ret < 0) if (ret < 0)
return ret; return ret;
dev = req_info.dev; dev = req_info.dev;
ret = -EOPNOTSUPP;
if (!dev->ethtool_ops->get_link_ksettings || if (!dev->ethtool_ops->get_link_ksettings ||
!dev->ethtool_ops->set_link_ksettings) !dev->ethtool_ops->set_link_ksettings)
return -EOPNOTSUPP; goto out_dev;
rtnl_lock(); rtnl_lock();
ret = ethnl_ops_begin(dev); ret = ethnl_ops_begin(dev);
...@@ -162,6 +163,7 @@ int ethnl_set_linkinfo(struct sk_buff *skb, struct genl_info *info) ...@@ -162,6 +163,7 @@ int ethnl_set_linkinfo(struct sk_buff *skb, struct genl_info *info)
ethnl_ops_complete(dev); ethnl_ops_complete(dev);
out_rtnl: out_rtnl:
rtnl_unlock(); rtnl_unlock();
out_dev:
dev_put(dev); dev_put(dev);
return ret; return ret;
} }
...@@ -338,9 +338,10 @@ int ethnl_set_linkmodes(struct sk_buff *skb, struct genl_info *info) ...@@ -338,9 +338,10 @@ int ethnl_set_linkmodes(struct sk_buff *skb, struct genl_info *info)
if (ret < 0) if (ret < 0)
return ret; return ret;
dev = req_info.dev; dev = req_info.dev;
ret = -EOPNOTSUPP;
if (!dev->ethtool_ops->get_link_ksettings || if (!dev->ethtool_ops->get_link_ksettings ||
!dev->ethtool_ops->set_link_ksettings) !dev->ethtool_ops->set_link_ksettings)
return -EOPNOTSUPP; goto out_dev;
rtnl_lock(); rtnl_lock();
ret = ethnl_ops_begin(dev); ret = ethnl_ops_begin(dev);
...@@ -370,6 +371,7 @@ int ethnl_set_linkmodes(struct sk_buff *skb, struct genl_info *info) ...@@ -370,6 +371,7 @@ int ethnl_set_linkmodes(struct sk_buff *skb, struct genl_info *info)
ethnl_ops_complete(dev); ethnl_ops_complete(dev);
out_rtnl: out_rtnl:
rtnl_unlock(); rtnl_unlock();
out_dev:
dev_put(dev); dev_put(dev);
return ret; return ret;
} }
...@@ -128,8 +128,9 @@ int ethnl_set_wol(struct sk_buff *skb, struct genl_info *info) ...@@ -128,8 +128,9 @@ int ethnl_set_wol(struct sk_buff *skb, struct genl_info *info)
if (ret < 0) if (ret < 0)
return ret; return ret;
dev = req_info.dev; dev = req_info.dev;
ret = -EOPNOTSUPP;
if (!dev->ethtool_ops->get_wol || !dev->ethtool_ops->set_wol) if (!dev->ethtool_ops->get_wol || !dev->ethtool_ops->set_wol)
return -EOPNOTSUPP; goto out_dev;
rtnl_lock(); rtnl_lock();
ret = ethnl_ops_begin(dev); ret = ethnl_ops_begin(dev);
...@@ -172,6 +173,7 @@ int ethnl_set_wol(struct sk_buff *skb, struct genl_info *info) ...@@ -172,6 +173,7 @@ int ethnl_set_wol(struct sk_buff *skb, struct genl_info *info)
ethnl_ops_complete(dev); ethnl_ops_complete(dev);
out_rtnl: out_rtnl:
rtnl_unlock(); rtnl_unlock();
out_dev:
dev_put(dev); dev_put(dev);
return ret; return ret;
} }
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment