From: Stephen Hemminger <shemminger@vyatta.com>
Date: Thu, 26 Mar 2009 04:01:47 +0000 (-0700)
Subject: bridge: bad error handling when adding invalid ether address
X-Git-Tag: v2.6.28.10~82
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=aa9c1ad9dedf3608e1449c65579001b27e573e18;p=thirdparty%2Fkernel%2Fstable.git

bridge: bad error handling when adding invalid ether address

[ Upstream commit cda6d377ec6b2ee2e58d563d0bd7eb313e0165df ]

This fixes an crash when empty bond device is added to a bridge.
If an interface with invalid ethernet address (all zero) is added
to a bridge, then bridge code detects it when setting up the forward
databas entry. But the error unwind is broken, the bridge port object
can get freed twice: once when ref count went to zeo, and once by kfree.
Since object is never really accessible, just free it.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 0a09ccf68c1c1..b8767f2b4dac7 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -426,7 +426,6 @@ err2:
 err1:
 	kobject_del(&p->kobj);
 err0:
-	kobject_put(&p->kobj);
 	dev_set_promiscuity(dev, -1);
 put_back:
 	dev_put(dev);