[PATCH] bonding: plug reference count leak

	Bonding leaks route structures when the ARP monitor is
configured to send probes over VLANs.

	Originally reported by Ian Abel <ian.abel@mxtelecom.com>; his
original fix was modified by Jay Vosburgh to correct coding style and to
close a leak it missed.

Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

1 files changed, 3 insertions, 0 deletions

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 94c9f68dd16b..f8dedb623dc0 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2879,6 +2879,7 @@ static void bond_arp_send_all(struct bonding *bond, struct slave *slave)
                  * This target is not on a VLAN
                  */
                 if (rt->u.dst.dev == bond->dev) {
+                        ip_rt_put(rt);
                         dprintk("basa: rtdev == bond->dev: arp_send\n");
                         bond_arp_send(slave->dev, ARPOP_REQUEST, targets[i],
                                       bond->master_ip, 0);
@@ -2898,6 +2899,7 @@ static void bond_arp_send_all(struct bonding *bond, struct slave *slave)
                 }
 
                 if (vlan_id) {
+                        ip_rt_put(rt);
                         bond_arp_send(slave->dev, ARPOP_REQUEST, targets[i],
                                       vlan->vlan_ip, vlan_id);
                         continue;
@@ -2909,6 +2911,7 @@ static void bond_arp_send_all(struct bonding *bond, struct slave *slave)
                                bond->dev->name, NIPQUAD(fl.fl4_dst),
                                rt->u.dst.dev ? rt->u.dst.dev->name : "NULL");
                 }
+                ip_rt_put(rt);
         }
 }