[PATCH net] ematch: Fix auto-loading of ematch modules.

["Ignacy Gawędzki" <ignacy.gawedzki@green-communications.fr>]

In tcf_em_validate(), when calling tcf_em_lookup(), don't put the resulting
pointer directly into em->ops, if the function is to possibly return -EAGAIN
after module auto-loading.  Otherwise, module_put() will be called by
tcf_em_tree_destroy() on em->ops->owner, while it has already been called by
tcf_em_validate() before return.

Signed-off-by: Ignacy Gawędzki <ignacy.gawedzki@green-communications.fr>
---
 net/sched/ematch.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/net/sched/ematch.c b/net/sched/ematch.c
index 6742200..39fbe2f 100644
--- a/net/sched/ematch.c
+++ b/net/sched/ematch.c
@@ -176,6 +176,7 @@ static int tcf_em_validate(struct tcf_proto *tp,
 {
 	int err = -EINVAL;
 	struct tcf_ematch_hdr *em_hdr = nla_data(nla);
+	struct tcf_ematch_ops *em_ops;
 	int data_len = nla_len(nla) - sizeof(*em_hdr);
 	void *data = (void *) em_hdr + sizeof(*em_hdr);
 	struct net *net = dev_net(qdisc_dev(tp->q));
@@ -213,27 +214,29 @@ static int tcf_em_validate(struct tcf_proto *tp,
 		 * here. Be aware, the destroy function assumes that the
 		 * module is held if the ops field is non zero.
 		 */
-		em->ops = tcf_em_lookup(em_hdr->kind);
+		em_ops = tcf_em_lookup(em_hdr->kind);
 
-		if (em->ops == NULL) {
+		if (em_ops == NULL) {
 			err = -ENOENT;
 #ifdef CONFIG_MODULES
 			__rtnl_unlock();
 			request_module("ematch-kind-%u", em_hdr->kind);
 			rtnl_lock();
-			em->ops = tcf_em_lookup(em_hdr->kind);
-			if (em->ops) {
+			em_ops = tcf_em_lookup(em_hdr->kind);
+			if (em_ops) {
 				/* We dropped the RTNL mutex in order to
 				 * perform the module load. Tell the caller
 				 * to replay the request.
 				 */
-				module_put(em->ops->owner);
+				module_put(em_ops->owner);
 				err = -EAGAIN;
 			}
 #endif
 			goto errout;
 		}
 
+		em->ops = em_ops;
+
 		/* ematch module provides expected length of data, so we
 		 * can do a basic sanity check.
 		 */
-- 
2.1.0