Ref-count problem in kset_find_obj?

[Martin Schwidefsky <schwidefsky@de.ibm.com>]

Hi Pat,
looking through the sysfs code I noticed a potential problem in
kset_find_obj:

struct kobject * kset_find_obj(struct kset * kset, const char * name)
{
        struct list_head * entry;
        struct kobject * ret = NULL;

        down_read(&kset->subsys->rwsem);
        list_for_each(entry,&kset->list) {
                struct kobject * k = to_kobj(entry);
                if (!strcmp(kobject_name(k),name)) {
			ret = k;
			break;
                }
        }
        up_read(&kset->subsys->rwsem);
        return ret;
}

The reference count of the kobject to be returned is not
increased before the semaphore is released. A kobject_del/unlink
could remove the object before the called of kset_find_obj is
able to increase the reference count. This makes kset_find_obj
more or less unusable, doesn't it?

blue skies,
  Martin.