diff --git a/net/802/garp.c b/net/802/garp.c index 400bd857e5f5..4a1ef95ae428 100644 --- a/net/802/garp.c +++ b/net/802/garp.c @@ -553,6 +553,16 @@ static void garp_release_port(struct net_device *dev) kfree_rcu(port, rcu); } +static void garp_destroy_remaining_attrs(struct garp_applicant *app) +{ + while (!RB_EMPTY_ROOT(&app->gid)) { + struct garp_attr *attr = + rb_entry(rb_first(&app->gid), + struct garp_attr, node); + garp_attr_destroy(app, attr); + } +} + int garp_init_applicant(struct net_device *dev, struct garp_application *appl) { struct garp_applicant *app; @@ -610,6 +620,13 @@ void garp_uninit_applicant(struct net_device *dev, struct garp_application *appl spin_lock_bh(&app->lock); garp_gid_event(app, GARP_EVENT_TRANSMIT_PDU); garp_pdu_queue(app); + + /* We need to free remaining attrs since this scenario is possible: + * garp_request_join() + * garp_request_leave() + * garp_uninit_applicant() + */ + garp_destroy_remaining_attrs(app); spin_unlock_bh(&app->lock); garp_queue_xmit(app); diff --git a/net/802/mrp.c b/net/802/mrp.c index bea6e43d45a0..bf319f3f2094 100644 --- a/net/802/mrp.c +++ b/net/802/mrp.c @@ -834,6 +834,16 @@ static void mrp_release_port(struct net_device *dev) kfree_rcu(port, rcu); } +static void mrp_destroy_remaining_attrs(struct mrp_applicant *app) +{ + while (!RB_EMPTY_ROOT(&app->mad)) { + struct mrp_attr *attr = + rb_entry(rb_first(&app->mad), + struct mrp_attr, node); + mrp_attr_destroy(app, attr); + } +} + int mrp_init_applicant(struct net_device *dev, struct mrp_application *appl) { struct mrp_applicant *app; @@ -896,6 +906,13 @@ void mrp_uninit_applicant(struct net_device *dev, struct mrp_application *appl) spin_lock_bh(&app->lock); mrp_mad_event(app, MRP_EVENT_TX); mrp_pdu_queue(app); + + /* We need to free remaining attrs since this scenario is possible: + * mrp_request_join() + * mrp_request_leave() + * mrp_uninit_applicant() + */ + mrp_destroy_remaining_attrs(app); spin_unlock_bh(&app->lock); mrp_queue_xmit(app);