When a user tried to delete a veth device through sysfs, the driver
wasn't properly parsing the device name. Also, it called
dev_get_by_name(), which increments a refcount on the device, but didn't
make a dev_put() before trying to delete it.
rtnl_unlock();
return retval ? retval : count;
} else if (c == '-') {
+ char devname[IFNAMSIZ + 1] = "";
struct net_device *dev;
+ strncat(devname, buffer,
+ min_t(int, sizeof devname, strcspn(buffer, "\n")));
rtnl_lock();
- dev = dev_get_by_name(buffer);
+ dev = __dev_get_by_name(devname);
if (!dev)
retval = -ENODEV;
else if (dev->init != veth_dev_init)