When updating an existing route entry in atrtr_create(), the old device
reference was not being released before assigning the new device,
leading to a device refcount leak. Fix this by calling dev_put() to
release the old device reference before holding the new one.

Fixes: c7f905f0f6d4 ("[ATALK]: Add missing dev_hold() to atrtr_create().")
Signed-off-by: veritas501 <hxzene@gmail.com>
---
 net/appletalk/ddp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 73ea7e67f05a..e5708870a249 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -576,6 +576,8 @@ static int atrtr_create(struct rtentry *r, struct net_device *devhint)
 
 	/* Fill in the routing entry */
 	rt->target  = ta->sat_addr;
+	if (rt->dev)
+		dev_put(rt->dev); /* Release old device */
 	dev_hold(devhint);
 	rt->dev     = devhint;
 	rt->flags   = r->rt_flags;
-- 
2.34.1

On Tue,  8 Jul 2025 09:04:30 +0000 veritas501 wrote:
> When updating an existing route entry in atrtr_create(), the old device
> reference was not being released before assigning the new device,
> leading to a device refcount leak. Fix this by calling dev_put() to
> release the old device reference before holding the new one.
> 
> Fixes: c7f905f0f6d4 ("[ATALK]: Add missing dev_hold() to atrtr_create().")
> Signed-off-by: veritas501 <hxzene@gmail.com>

we need your real name

> diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
> index 73ea7e67f05a..e5708870a249 100644
> --- a/net/appletalk/ddp.c
> +++ b/net/appletalk/ddp.c
> @@ -576,6 +576,8 @@ static int atrtr_create(struct rtentry *r, struct net_device *devhint)
>  
>  	/* Fill in the routing entry */
>  	rt->target  = ta->sat_addr;
> +	if (rt->dev)
> +		dev_put(rt->dev); /* Release old device */

null check is not necessary before dev_put()
-- 
pw-bot: cr