af-packet: Hold reference to bound network devices.

Old code was probably safe, but with this change we
can actually use the netdev object, not just compare
the pointer values.

Signed-off-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 9 insertions, 5 deletions

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index ba248d93399a..636b75c15a63 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1342,6 +1342,10 @@ static int packet_release(struct socket *sock)
                 __dev_remove_pack(&po->prot_hook);
                 __sock_put(sk);
         }
+        if (po->prot_hook.dev) {
+                dev_put(po->prot_hook.dev);
+                po->prot_hook.dev = NULL;
+        }
         spin_unlock(&po->bind_lock);
 
         packet_flush_mclist(sk);
@@ -1395,6 +1399,8 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protoc
 
         po->num = protocol;
         po->prot_hook.type = protocol;
+        if (po->prot_hook.dev)
+                dev_put(po->prot_hook.dev);
         po->prot_hook.dev = dev;
 
         po->ifindex = dev ? dev->ifindex : 0;
@@ -1439,10 +1445,8 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr,
         strlcpy(name, uaddr->sa_data, sizeof(name));
 
         dev = dev_get_by_name(sock_net(sk), name);
-        if (dev) {
+        if (dev)
                 err = packet_do_bind(sk, dev, pkt_sk(sk)->num);
-                dev_put(dev);
-        }
         return err;
 }
 
@@ -1470,8 +1474,6 @@ static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len
                         goto out;
         }
         err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num);
-        if (dev)
-                dev_put(dev);
 
 out:
         return err;
@@ -2240,6 +2242,8 @@ static int packet_notifier(struct notifier_block *this, unsigned long msg, void
                                 }
                                 if (msg == NETDEV_UNREGISTER) {
                                         po->ifindex = -1;
+                                        if (po->prot_hook.dev)
+                                                dev_put(po->prot_hook.dev);
                                         po->prot_hook.dev = NULL;
                                 }
                                 spin_unlock(&po->bind_lock);