rtnetlink: fix a memory leak when ->newlink fails

It is possible that ->newlink() fails before registering
the device, in this case we should just free it, it's
safe to call free_netdev().

Fixes: commit 0e0eee2465df77bcec2 (net: correct error path in rtnl_newlink())
Cc: David S. Miller <davem@davemloft.net>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Cong Wang <cwang@twopensource.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 7 insertions, 3 deletions

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 2d8d8fcfa060..f4e9037f9a0c 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2019,11 +2019,15 @@ replay:
                 if (ops->newlink) {
                         err = ops->newlink(net, dev, tb, data);
                         /* Drivers should call free_netdev() in ->destructor
-                         * and unregister it on failure so that device could be
-                         * finally freed in rtnl_unlock.
+                         * and unregister it on failure after registration
+                         * so that device could be finally freed in rtnl_unlock.
                          */
-                        if (err < 0)
+                        if (err < 0) {
+                                /* If device is not registered at all, free it now */
+                                if (dev->reg_state == NETREG_UNINITIALIZED)
+                                        free_netdev(dev);
                                 goto out;
+                        }
                 } else {
                         err = register_netdevice(dev);
                         if (err < 0) {