[3.19.y-ckt stable] Patch "packet: missing dev_put() in packet_do_bind()" has been added to staging queue

[Kamal Mostafa]

This is a note to let you know that I have just added a patch titled

    packet: missing dev_put() in packet_do_bind()

to the linux-3.19.y-queue branch of the 3.19.y-ckt extended stable tree 
which can be found at:

    http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-3.19.y-queue

This patch is scheduled to be released in version 3.19.8-ckt6.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.19.y-ckt tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

>From 63898585f48f1ab5361e897152d83607a4f216f9 Mon Sep 17 00:00:00 2001
From: Lars Westerhoff <lars.westerhoff at newtec.eu>
Date: Tue, 28 Jul 2015 01:32:21 +0300
Subject: packet: missing dev_put() in packet_do_bind()

commit 158cd4af8dedbda0d612d448c724c715d0dda649 upstream.

When binding a PF_PACKET socket, the use count of the bound interface is
always increased with dev_hold in dev_get_by_{index,name}.  However,
when rebound with the same protocol and device as in the previous bind
the use count of the interface was not decreased.  Ultimately, this
caused the deletion of the interface to fail with the following message:

unregister_netdevice: waiting for dummy0 to become free. Usage count = 1

This patch moves the dev_put out of the conditional part that was only
executed when either the protocol or device changed on a bind.

Fixes: 902fefb82ef7 ('packet: improve socket create/bind latency in some cases')
Signed-off-by: Lars Westerhoff <lars.westerhoff at newtec.eu>
Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
Reviewed-by: Daniel Borkmann <dborkman at redhat.com>
Signed-off-by: David S. Miller <davem at davemloft.net>
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
---
 net/packet/af_packet.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index ea36bec..8da43cb 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2668,7 +2668,7 @@ static int packet_release(struct socket *sock)
 static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto)
 {
 	struct packet_sock *po = pkt_sk(sk);
-	const struct net_device *dev_curr;
+	struct net_device *dev_curr;
 	__be16 proto_curr;
 	bool need_rehook;

@@ -2692,15 +2692,13 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto)

 		po->num = proto;
 		po->prot_hook.type = proto;
-
-		if (po->prot_hook.dev)
-			dev_put(po->prot_hook.dev);
-
 		po->prot_hook.dev = dev;

 		po->ifindex = dev ? dev->ifindex : 0;
 		packet_cached_dev_assign(po, dev);
 	}
+	if (dev_curr)
+		dev_put(dev_curr);

 	if (proto == 0 || !need_rehook)
 		goto out_unlock;
--
1.9.1