Arnd Bergmann wrote:
> +static int macvtap_newlink(struct net *src_net,
> + struct net_device *dev,
> + struct nlattr *tb[],
> + struct nlattr *data[])
> +{
> + struct device *classdev;
> + dev_t devt;
> + int err;
> +
> + err = macvlan_common_newlink(src_net, dev, tb, data,
> + macvtap_receive, macvtap_forward);
> + if (err)
> + goto out;
> +
> + devt = MKDEV(MAJOR(macvtap_major), dev->ifindex);
> +
> + classdev = device_create(macvtap_class, &dev->dev, devt,
> + dev, "tap%d", dev->ifindex);
> + if (IS_ERR(classdev)) {
> + err = PTR_ERR(classdev);
> + macvtap_del_queues(dev);
> + macvlan_dellink(dev, NULL);
I think this may cause a double free since macvlan_dellink() will
free the device and rtnl_newlink() will free it again on error.
> + }
> +
> +out:
> + return err;
> +}
> +
> +static void macvtap_dellink(struct net_device *dev,
> + struct list_head *head)
> +{
> + device_destroy(macvtap_class,
> + MKDEV(MAJOR(macvtap_major), dev->ifindex));
> +
> + macvtap_del_queues(dev);
> + macvlan_dellink(dev, head);
> +}
> +
> +static struct rtnl_link_ops macvtap_link_ops __read_mostly = {
> + .kind = "macvtap",
> + .newlink = macvtap_newlink,
> + .dellink = macvtap_dellink,
> +};
_______________________________________________
Bridge mailing list
Bridge@xxxxxxxxxxxxxxxxxxxxxxxxxx
https://lists.linux-foundation.org/mailman/listinfo/bridge
