bonding: fix NULL deref in bond_rr_gen_slave_id

[linux-stable] / drivers / net / bonding / bond_main.c

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 83852e6719e26d172d81f5d6bdbc7c964daa27f9..ab7cb48f8dfdd105ed23479f93e4bdafee92a651 100644 (file)
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4155,6 +4155,12 @@ static int bond_open(struct net_device *bond_dev)
        struct list_head *iter;
        struct slave *slave;
 
+       if (BOND_MODE(bond) == BOND_MODE_ROUNDROBIN && !bond->rr_tx_counter) {
+               bond->rr_tx_counter = alloc_percpu(u32);
+               if (!bond->rr_tx_counter)
+                       return -ENOMEM;
+       }
+
        /* reset slave->backup and slave->inactive */
        if (bond_has_slaves(bond)) {
                bond_for_each_slave(bond, slave, iter) {
@@ -6210,15 +6216,6 @@ static int bond_init(struct net_device *bond_dev)
        if (!bond->wq)
                return -ENOMEM;
 
-       if (BOND_MODE(bond) == BOND_MODE_ROUNDROBIN) {
-               bond->rr_tx_counter = alloc_percpu(u32);
-               if (!bond->rr_tx_counter) {
-                       destroy_workqueue(bond->wq);
-                       bond->wq = NULL;
-                       return -ENOMEM;
-               }
-       }
-
        spin_lock_init(&bond->stats_lock);
        netdev_lockdep_set_classes(bond_dev);