tty: use krefs to protect driver module counts

The tty layer keeps driver module counts that are used so the driver knows
when it can be unloaded. For obvious reasons we want to tie that to the
refcounting properly.

At this point the driver side itself isn't refcounted nicely but we can do
that later and kref the drivers.

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 11 insertions, 6 deletions

diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 310e0703e4a1..fa162c93ee02 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -1293,6 +1293,12 @@ static int init_dev(struct tty_driver *driver, int idx,
                 o_tty = alloc_tty_struct();
                 if (!o_tty)
                         goto free_mem_out;
+                if (!try_module_get(driver->other->owner)) {
+                        /* This cannot in fact currently happen */
+                        free_tty_struct(o_tty);
+                        o_tty = NULL;
+                        goto free_mem_out;
+                }
                 initialize_tty_struct(o_tty);
                 o_tty->driver = driver->other;
                 o_tty->ops = driver->ops;
@@ -1411,8 +1417,10 @@ end_init:
         /* Release locally allocated memory ... nothing placed in slots */
 free_mem_out:
         kfree(o_tp);
-        if (o_tty)
+        if (o_tty) {
+                module_put(o_tty->driver->owner);
                 free_tty_struct(o_tty);
+        }
         kfree(ltp);
         kfree(tp);
         free_tty_struct(tty);
@@ -1447,6 +1455,7 @@ release_mem_out:
 static void release_one_tty(struct kref *kref)
 {
         struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
+        struct tty_driver *driver = tty->driver;
         int devpts = tty->driver->flags & TTY_DRIVER_DEVPTS_MEM;
         struct ktermios *tp;
         int idx = tty->index;
@@ -1471,6 +1480,7 @@ static void release_one_tty(struct kref *kref)
         tty->magic = 0;
         /* FIXME: locking on tty->driver->refcount */
         tty->driver->refcount--;
+        module_put(driver->owner);
 
         file_list_lock();
         list_del_init(&tty->tty_files);
@@ -1506,20 +1516,15 @@ EXPORT_SYMBOL(tty_kref_put);
  *      of ttys that the driver keeps.
  *              FIXME: should we require tty_mutex is held here ??
  *
- *      FIXME: We want to defer the module put of the driver to the
- *      destructor.
  */
 static void release_tty(struct tty_struct *tty, int idx)
 {
-        struct tty_driver *driver = tty->driver;
-
         /* This should always be true but check for the moment */
         WARN_ON(tty->index != idx);
 
         if (tty->link)
                 tty_kref_put(tty->link);
         tty_kref_put(tty);
-        module_put(driver->owner);
 }
 
 /*