[LLC]: Fix sap refcounting

Thanks to Leslie Harlley Watter <leslie@watter.org> for reporting the
problem an testing this patch.

Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 233794435bb80d60837059c6db39ce87707d3c4b..5a04db745c8d64394ce074cdecaa69d84ede0aa0 100644 (file)
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -187,8 +187,10 @@ static int llc_ui_release(struct socket *sock)
                llc->laddr.lsap, llc->daddr.lsap);
        if (!llc_send_disc(sk))
                llc_ui_wait_for_disc(sk, sk->sk_rcvtimeo);
-       if (!sock_flag(sk, SOCK_ZAPPED))
+       if (!sock_flag(sk, SOCK_ZAPPED)) {
+               llc_sap_put(llc->sap);
                llc_sap_remove_socket(llc->sap, sk);
+       }
        release_sock(sk);
        if (llc->dev)
                dev_put(llc->dev);

diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c
index ab0fcd32fd8447bf69b5ee10848dc0afa88c53df..bd242a49514add8e1d9a128b937904389e065dbc 100644 (file)
--- a/net/llc/llc_core.c
+++ b/net/llc/llc_core.c
@@ -127,7 +127,6 @@ struct llc_sap *llc_sap_open(unsigned char lsap,
                goto out;
        sap->laddr.lsap = lsap;
        sap->rcv_func   = func;
-       llc_sap_hold(sap);
        llc_add_sap(sap);
 out:
        write_unlock_bh(&llc_sap_list_lock);