dlci: acquire rtnl_lock before calling __dev_get_by_name()

Otherwise the net device returned can be freed at anytime.

Signed-off-by: Li Zefan <lizefan@huawei.com>
Cc: stable@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 9 insertions, 5 deletions

diff --git a/drivers/net/wan/dlci.c b/drivers/net/wan/dlci.c
index 147614ed86aa..1f6e0538c716 100644
--- a/drivers/net/wan/dlci.c
+++ b/drivers/net/wan/dlci.c
@@ -385,20 +385,24 @@ static int dlci_del(struct dlci_add *dlci)
         struct net_device       *master, *slave;
         int                     err;
 
+        rtnl_lock();
+
         /* validate slave device */
         master = __dev_get_by_name(&init_net, dlci->devname);
-        if (!master)
-                return -ENODEV;
+        if (!master) {
+                err = -ENODEV;
+                goto out;
+        }
 
         if (netif_running(master)) {
-                return -EBUSY;
+                err = -EBUSY;
+                goto out;
         }
 
         dlp = netdev_priv(master);
         slave = dlp->slave;
         flp = netdev_priv(slave);
 
-        rtnl_lock();
         err = (*flp->deassoc)(slave, master);
         if (!err) {
                 list_del(&dlp->list);
@@ -407,8 +411,8 @@ static int dlci_del(struct dlci_add *dlci)
 
                 dev_put(slave);
         }
+out:
         rtnl_unlock();
-
         return err;
 }