[LLC]: Fix sap refcounting

Thanks to Leslie Harlley Watter <leslie@watter.org> for reporting the
problem an testing this patch.

Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 3 insertions, 2 deletions

diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 233794435bb8..5a04db745c8d 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -187,8 +187,10 @@ static int llc_ui_release(struct socket *sock)
                 llc->laddr.lsap, llc->daddr.lsap);
         if (!llc_send_disc(sk))
                 llc_ui_wait_for_disc(sk, sk->sk_rcvtimeo);
-        if (!sock_flag(sk, SOCK_ZAPPED))
+        if (!sock_flag(sk, SOCK_ZAPPED)) {
+                llc_sap_put(llc->sap);
                 llc_sap_remove_socket(llc->sap, sk);
+        }
         release_sock(sk);
         if (llc->dev)
                 dev_put(llc->dev);
diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c
index ab0fcd32fd84..bd242a49514a 100644
--- a/net/llc/llc_core.c
+++ b/net/llc/llc_core.c
@@ -127,7 +127,6 @@ struct llc_sap *llc_sap_open(unsigned char lsap,
                 goto out;
         sap->laddr.lsap = lsap;
         sap->rcv_func   = func;
-        llc_sap_hold(sap);
         llc_add_sap(sap);
 out:
         write_unlock_bh(&llc_sap_list_lock);