From 196748a276b4dee01177e6b7abcda27cd759de83 Mon Sep 17 00:00:00 2001 From: Paul Durrant Date: Mon, 2 Dec 2019 11:41:16 +0000 Subject: xen/xenbus: reference count registered modules To prevent a PV driver module being removed whilst attached to its other end, and hence xenbus calling into potentially invalid text, take a reference on the module before calling the probe() method (dropping it if unsuccessful) and drop the reference after returning from the remove() method. Suggested-by: Jan Beulich Signed-off-by: Paul Durrant Reviewed-by: Jan Beulich Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross --- drivers/xen/xenbus/xenbus_probe.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) (limited to 'drivers/xen') diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c index 5b471889d723..c21be6e9d38a 100644 --- a/drivers/xen/xenbus/xenbus_probe.c +++ b/drivers/xen/xenbus/xenbus_probe.c @@ -232,9 +232,16 @@ int xenbus_dev_probe(struct device *_dev) return err; } + if (!try_module_get(drv->driver.owner)) { + dev_warn(&dev->dev, "failed to acquire module reference on '%s'\n", + drv->driver.name); + err = -ESRCH; + goto fail; + } + err = drv->probe(dev, id); if (err) - goto fail; + goto fail_put; err = watch_otherend(dev); if (err) { @@ -244,6 +251,8 @@ int xenbus_dev_probe(struct device *_dev) } return 0; +fail_put: + module_put(drv->driver.owner); fail: xenbus_dev_error(dev, err, "xenbus_dev_probe on %s", dev->nodename); xenbus_switch_state(dev, XenbusStateClosed); @@ -263,6 +272,8 @@ int xenbus_dev_remove(struct device *_dev) if (drv->remove) drv->remove(dev); + module_put(drv->driver.owner); + free_otherend_details(dev); xenbus_switch_state(dev, XenbusStateClosed); -- cgit v1.2.3