[PATCH] stm class: fail stm_lookup_protocol() when the protocol module is going away

[PATCH] stm class: fail stm_lookup_protocol() when the protocol module is going away

[Yu Zhang]

stm_lookup_protocol() returns 0 whenever a protocol entry with the given
name exists, even if stm_get_protocol() failed because the protocol
module is being unloaded. In that case *pdrv and *node_type are left
untouched and stp_policy_make() goes on to install two uninitialised
stack pointers as stm->pdrv and stm->pdrv_node_type, and its error path
and stp_policy_unbind() later dereference them to drop a module
reference that was never taken.

Return -ENOENT unless the protocol was found and its module reference
taken.

Fixes: c7fd62bc69d0 ("stm class: Introduce framing protocol drivers")
Cc: stable@vger.kernel.org
Signed-off-by: Yu Zhang <yuz08559@gmail.com>
---
 drivers/hwtracing/stm/core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index f48c6a8..5fbea4e 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c
@@ -468,6 +468,7 @@ int stm_lookup_protocol(const char *name,
 			const struct config_item_type **node_type)
 {
 	const struct stm_pdrv_entry *pe;
+	int ret = -ENOENT;
 
 	mutex_lock(&stm_pdrv_mutex);
 
@@ -475,11 +476,12 @@ int stm_lookup_protocol(const char *name,
 	if (pe && pe->pdrv && stm_get_protocol(pe->pdrv)) {
 		*pdrv = pe->pdrv;
 		*node_type = pe->node_type;
+		ret = 0;
 	}
 
 	mutex_unlock(&stm_pdrv_mutex);
 
-	return pe ? 0 : -ENOENT;
+	return ret;
 }
 
 static int stm_char_open(struct inode *inode, struct file *file)
-- 
2.43.0