From: Arnd Bergmann <arnd@arndb.de>
Date: Fri, 9 Dec 2005 18:04:15 +0000 (+0100)
Subject: [PATCH] spufs: fix module refcount race
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=59d6d39f30f4460b7e6489831caf7fbfe371941a;p=GitHub%2FLineageOS%2FG12%2Fandroid_kernel_amlogic_linux-4.9.git

[PATCH] spufs: fix module refcount race

One of the two users of spufs_calls.owner still has a race
when calling try_module_get while the module is removed.
This makes it use the correct instance of owner.

Noticed by Milton Miller.

Signed-off-by: Arnd Bergmann <arndb@de.ibm.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>
---

diff --git a/arch/powerpc/platforms/cell/spu_syscalls.c b/arch/powerpc/platforms/cell/spu_syscalls.c
index 91d564df944e..261b507a901a 100644
--- a/arch/powerpc/platforms/cell/spu_syscalls.c
+++ b/arch/powerpc/platforms/cell/spu_syscalls.c
@@ -40,7 +40,7 @@ asmlinkage long sys_spu_create(const char __user *name,
 	struct module *owner = spufs_calls.owner;
 
 	ret = -ENOSYS;
-	if (owner && try_module_get(spufs_calls.owner)) {
+	if (owner && try_module_get(owner)) {
 		ret = spufs_calls.create_thread(name, flags, mode);
 		module_put(owner);
 	}