When a device goes down, nr_rt_device_down() clears the routes that use this device. However, it fails to drop the per-route reference to the neighbour (nr_neigh): neither nr_neigh->count nor its refcount is decremented when the route is removed.
Mirror the behaviour of nr_dec_obs() / nr_del_node() by decrementing nr_neigh->count and calling nr_neigh_put(), so that the neighbour reference is properly released when a device goes down.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Junjie Cao junjie.cao@intel.com --- net/netrom/nr_route.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c index 20aacfdfccd4..35d10985fd7a 100644 --- a/net/netrom/nr_route.c +++ b/net/netrom/nr_route.c @@ -517,6 +517,9 @@ void nr_rt_device_down(struct net_device *dev) for (i = 0; i < t->count; i++) { s = t->routes[i].neighbour; if (s->dev == dev) { + s->count--; + nr_neigh_put(s); + t->count--;
switch (i) {