[PATCH] farsync: add module_put to error path in fst_open()

[PATCH] farsync: add module_put to error path in fst_open()

[Pavel Shved]

The fst_open() function, after a successful try_module_get() may return
an error code if hdlc_open() returns it.  However, it does not put the
module on this error path.

This patch adds the necessary module_put() call.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Pavel Shved <shved@ispras.ru>
---
 drivers/net/wan/farsync.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c
index e050bd6..777d1a4 100644
--- a/drivers/net/wan/farsync.c
+++ b/drivers/net/wan/farsync.c
@@ -2203,8 +2203,10 @@ fst_open(struct net_device *dev)
 
 	if (port->mode != FST_RAW) {
 		err = hdlc_open(dev);
-		if (err)
+		if (err) {
+			module_put(THIS_MODULE);
 			return err;
+		}
 	}
 
 	fst_openport(port);
-- 
1.7.0.2

[PATCH] gigaset: call module_put before restart of if_open()

[Pavel Shved]

if_open() calls try_module_get(), and after an attempt to lock a mutex
the if_open() function may return -ERESTARTSYS without
putting the module.  Then, when if_open() is executed again,
try_module_get() is called making the reference counter of THIS_MODULE
greater than one at successful exit from if_open().  The if_close()
function puts the module only once, and as a result it can't be
unloaded.

This patch adds module_put call before the return from if_open().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Pavel Shved <shved@ispras.ru>
---
 drivers/isdn/gigaset/interface.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
index 59de638..e35058b 100644
--- a/drivers/isdn/gigaset/interface.c
+++ b/drivers/isdn/gigaset/interface.c
@@ -156,8 +156,10 @@ static int if_open(struct tty_struct *tty, struct file *filp)
 	if (!cs || !try_module_get(cs->driver->owner))
 		return -ENODEV;
 
-	if (mutex_lock_interruptible(&cs->mutex))
+	if (mutex_lock_interruptible(&cs->mutex)) {
+		module_put(cs->driver->owner);
 		return -ERESTARTSYS;
+	}
 	tty->driver_data = cs;
 
 	++cs->open_count;
-- 
1.7.0.2

Re: [PATCH] gigaset: call module_put before restart of if_open()

[David Miller]

From: Pavel Shved <shved@ispras.ru>
Date: Fri, 17 Jun 2011 20:25:11 +0400

> if_open() calls try_module_get(), and after an attempt to lock a mutex
> the if_open() function may return -ERESTARTSYS without
> putting the module.  Then, when if_open() is executed again,
> try_module_get() is called making the reference counter of THIS_MODULE
> greater than one at successful exit from if_open().  The if_close()
> function puts the module only once, and as a result it can't be
> unloaded.
> 
> This patch adds module_put call before the return from if_open().
> 
> Found by Linux Driver Verification project (linuxtesting.org).
> 
> Signed-off-by: Pavel Shved <shved@ispras.ru>

Applied.

[PATCH] hecubafb: add module_put on error path in hecubafb_probe()

[Pavel Shved]

In hecubafb_probe(), after a successful try_module_get, vzalloc may
fail and make the hecubafb_probe return, but the module is not put on
this error path.

This patch adds an exit point that calls module_put in such situation.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Pavel Shved <shved@ispras.ru>
---
 drivers/video/hecubafb.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/drivers/video/hecubafb.c b/drivers/video/hecubafb.c
index fbef15f..614251a 100644
--- a/drivers/video/hecubafb.c
+++ b/drivers/video/hecubafb.c
@@ -233,7 +233,7 @@ static int __devinit hecubafb_probe(struct platform_device *dev)
 
 	videomemory = vzalloc(videomemorysize);
 	if (!videomemory)
-		return retval;
+		goto err_videomem_alloc;
 
 	info = framebuffer_alloc(sizeof(struct hecubafb_par), &dev->dev);
 	if (!info)
@@ -275,6 +275,7 @@ err_fbreg:
 	framebuffer_release(info);
 err_fballoc:
 	vfree(videomemory);
+err_videomem_alloc:
 	module_put(board->owner);
 	return retval;
 }
-- 
1.7.0.2

Re: [PATCH] hecubafb: add module_put on error path in hecubafb_probe()

[Paul Mundt]

On Fri, Jun 17, 2011 at 08:25:12PM +0400, Pavel Shved wrote:
> In hecubafb_probe(), after a successful try_module_get, vzalloc may
> fail and make the hecubafb_probe return, but the module is not put on
> this error path.
> 
> This patch adds an exit point that calls module_put in such situation.
> 
> Found by Linux Driver Verification project (linuxtesting.org).
> 
> Signed-off-by: Pavel Shved <shved@ispras.ru>

Applied, thanks.

[PATCH] synclink_gt: add module_put on error path in hdlcdev_open()

[Pavel Shved]

hdlcdev_open() calls try_module_get, and does not put the module when
other functions subsequently called fail.

The patch adds an exit point in hdlcdev_open() that calls module_put()
after such errors.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Pavel Shved <shved@ispras.ru>
---
 drivers/tty/synclink_gt.c |   11 ++++++++---
 1 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
index 18b48cd..e1e89a0 100644
--- a/drivers/tty/synclink_gt.c
+++ b/drivers/tty/synclink_gt.c
@@ -1542,14 +1542,15 @@ static int hdlcdev_open(struct net_device *dev)
 
 	/* generic HDLC layer open processing */
 	if ((rc = hdlc_open(dev)))
-		return rc;
+		goto do_put;
 
 	/* arbitrate between network and tty opens */
 	spin_lock_irqsave(&info->netlock, flags);
 	if (info->port.count != 0 || info->netcount != 0) {
 		DBGINFO(("%s hdlc_open busy\n", dev->name));
 		spin_unlock_irqrestore(&info->netlock, flags);
-		return -EBUSY;
+		rc = -EBUSY;
+		goto do_put;
 	}
 	info->netcount=1;
 	spin_unlock_irqrestore(&info->netlock, flags);
@@ -1559,7 +1560,7 @@ static int hdlcdev_open(struct net_device *dev)
 		spin_lock_irqsave(&info->netlock, flags);
 		info->netcount=0;
 		spin_unlock_irqrestore(&info->netlock, flags);
-		return rc;
+		goto do_put;
 	}
 
 	/* assert DTR and RTS, apply hardware settings */
@@ -1579,6 +1580,10 @@ static int hdlcdev_open(struct net_device *dev)
 	else
 		netif_carrier_off(dev);
 	return 0;
+
+do_put:
+	module_put(THIS_MODULE);
+	return rc;
 }
 
 /**
-- 
1.7.0.2

Re: [PATCH] farsync: add module_put to error path in fst_open()

[David Miller]

From: Pavel Shved <shved@ispras.ru>
Date: Fri, 17 Jun 2011 20:25:10 +0400

> The fst_open() function, after a successful try_module_get() may return
> an error code if hdlc_open() returns it.  However, it does not put the
> module on this error path.
> 
> This patch adds the necessary module_put() call.
> 
> Found by Linux Driver Verification project (linuxtesting.org).
> 
> Signed-off-by: Pavel Shved <shved@ispras.ru>

Applied.