When bulk delete command is received in the rtnetlink_rcv_msg function,
if bulk delete is not supported, module_put is not called to release
the reference counting. As a result, module reference count is leaked.

Fixes: a6cec0bcd342("net: rtnetlink: add bulk delete support flag")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
---
 net/core/rtnetlink.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index ac45328607f7..4b5b15c684ed 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -6070,6 +6070,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
 	if (kind == RTNL_KIND_DEL && (nlh->nlmsg_flags & NLM_F_BULK) &&
 	    !(flags & RTNL_FLAG_BULK_DEL_SUPPORTED)) {
 		NL_SET_ERR_MSG(extack, "Bulk delete is not supported");
+		module_put(owner);
 		goto err_unlock;
 	}
 
-- 
2.17.1

Hello:

This patch was applied to netdev/net.git (master)
by Jakub Kicinski <kuba@kernel.org>:

On Mon, 15 Aug 2022 10:46:29 +0800 you wrote:
> When bulk delete command is received in the rtnetlink_rcv_msg function,
> if bulk delete is not supported, module_put is not called to release
> the reference counting. As a result, module reference count is leaked.
> 
> Fixes: a6cec0bcd342("net: rtnetlink: add bulk delete support flag")
> Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
> 
> [...]

Here is the summary with links:
  - [net-next] net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg
    https://git.kernel.org/netdev/net/c/5b22f62724a0

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

On 15/08/2022 05:46, Zhengchao Shao wrote:
> When bulk delete command is received in the rtnetlink_rcv_msg function,
> if bulk delete is not supported, module_put is not called to release
> the reference counting. As a result, module reference count is leaked.
> 
> Fixes: a6cec0bcd342("net: rtnetlink: add bulk delete support flag")
> Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
> ---
>  net/core/rtnetlink.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
> index ac45328607f7..4b5b15c684ed 100644
> --- a/net/core/rtnetlink.c
> +++ b/net/core/rtnetlink.c
> @@ -6070,6 +6070,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
>  	if (kind == RTNL_KIND_DEL && (nlh->nlmsg_flags & NLM_F_BULK) &&
>  	    !(flags & RTNL_FLAG_BULK_DEL_SUPPORTED)) {
>  		NL_SET_ERR_MSG(extack, "Bulk delete is not supported");
> +		module_put(owner);
>  		goto err_unlock;
>  	}
>  

Oops, thanks.
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>

On 15/08/2022 08:44, Nikolay Aleksandrov wrote:
> On 15/08/2022 05:46, Zhengchao Shao wrote:
>> When bulk delete command is received in the rtnetlink_rcv_msg function,
>> if bulk delete is not supported, module_put is not called to release
>> the reference counting. As a result, module reference count is leaked.
>>
>> Fixes: a6cec0bcd342("net: rtnetlink: add bulk delete support flag")
>> Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
>> ---
>>  net/core/rtnetlink.c | 1 +
>>  1 file changed, 1 insertion(+)
>>
>> diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
>> index ac45328607f7..4b5b15c684ed 100644
>> --- a/net/core/rtnetlink.c
>> +++ b/net/core/rtnetlink.c
>> @@ -6070,6 +6070,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
>>  	if (kind == RTNL_KIND_DEL && (nlh->nlmsg_flags & NLM_F_BULK) &&
>>  	    !(flags & RTNL_FLAG_BULK_DEL_SUPPORTED)) {
>>  		NL_SET_ERR_MSG(extack, "Bulk delete is not supported");
>> +		module_put(owner);
>>  		goto err_unlock;
>>  	}
>>  
> 
> Oops, thanks.
> Acked-by: Nikolay Aleksandrov <razor@blackwall.org>

By the way I think this should be targeted at -net,
I didn't notice the net-next tag earlier.