Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  ppp: fix segfaults introduced by netdev_priv changes
  net: Fix module refcount leak in kernel_accept()

diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 7e857e938adb582ae432b26d35114e8099d51eb2..714a23035de1980a968c19a835712d587c007c17 100644 (file)
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -116,6 +116,7 @@ struct ppp {
        unsigned long   last_xmit;      /* jiffies when last pkt sent 9c */
        unsigned long   last_recv;      /* jiffies when last pkt rcvd a0 */
        struct net_device *dev;         /* network interface device a4 */
+       int             closing;        /* is device closing down? a8 */
 #ifdef CONFIG_PPP_MULTILINK
        int             nxchan;         /* next channel to send something on */
        u32             nxseq;          /* next sequence number to send */
@@ -995,7 +996,7 @@ ppp_xmit_process(struct ppp *ppp)
        struct sk_buff *skb;
 
        ppp_xmit_lock(ppp);
-       if (ppp->dev) {
+       if (!ppp->closing) {
                ppp_push(ppp);
                while (!ppp->xmit_pending
                       && (skb = skb_dequeue(&ppp->file.xq)))
@@ -1463,8 +1464,7 @@ static inline void
 ppp_do_recv(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
 {
        ppp_recv_lock(ppp);
-       /* ppp->dev == 0 means interface is closing down */
-       if (ppp->dev)
+       if (!ppp->closing)
                ppp_receive_frame(ppp, skb, pch);
        else
                kfree_skb(skb);
@@ -2498,18 +2498,16 @@ init_ppp_file(struct ppp_file *pf, int kind)
  */
 static void ppp_shutdown_interface(struct ppp *ppp)
 {
-       struct net_device *dev;
-
        mutex_lock(&all_ppp_mutex);
-       ppp_lock(ppp);
-       dev = ppp->dev;
-       ppp->dev = NULL;
-       ppp_unlock(ppp);
        /* This will call dev_close() for us. */
-       if (dev) {
-               unregister_netdev(dev);
-               free_netdev(dev);
-       }
+       ppp_lock(ppp);
+       if (!ppp->closing) {
+               ppp->closing = 1;
+               ppp_unlock(ppp);
+               unregister_netdev(ppp->dev);
+       } else
+               ppp_unlock(ppp);
+
        cardmap_set(&all_ppp_units, ppp->file.index, NULL);
        ppp->file.dead = 1;
        ppp->owner = NULL;
@@ -2554,7 +2552,7 @@ static void ppp_destroy_interface(struct ppp *ppp)
        if (ppp->xmit_pending)
                kfree_skb(ppp->xmit_pending);
 
-       kfree(ppp);
+       free_netdev(ppp->dev);
 }
 
 /*
@@ -2616,7 +2614,7 @@ ppp_connect_channel(struct channel *pch, int unit)
        if (pch->file.hdrlen > ppp->file.hdrlen)
                ppp->file.hdrlen = pch->file.hdrlen;
        hdrlen = pch->file.hdrlen + 2;  /* for protocol bytes */
-       if (ppp->dev && hdrlen > ppp->dev->hard_header_len)
+       if (hdrlen > ppp->dev->hard_header_len)
                ppp->dev->hard_header_len = hdrlen;
        list_add_tail(&pch->clist, &ppp->channels);
        ++ppp->n_channels;

diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index ba537fae0a4ca653b4a7eedb7b941deb8aef613b..ce68e046d963840e4a3822972ed33f2a30a86244 100644 (file)
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -1786,8 +1786,6 @@ static inline void rfcomm_accept_connection(struct rfcomm_session *s)
        if (err < 0)
                return;
 
-       __module_get(nsock->ops->owner);
-
        /* Set our callbacks */
        nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
        nsock->sk->sk_state_change = rfcomm_l2state_change;

diff --git a/net/socket.c b/net/socket.c
index 92764d836891833e1cb7f8255a38edacad1f3b7f..76ba80aeac1a86217ae77edc0e239084840f90d6 100644 (file)
--- a/net/socket.c
+++ b/net/socket.c
@@ -2307,6 +2307,7 @@ int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
        }
 
        (*newsock)->ops = sock->ops;
+       __module_get((*newsock)->ops->owner);
 
 done:
        return err;