staging: comedi: increment reference while file open

In the 'open' file operation handler `comedi_open()` in "comedi_fops.c",
call `comedi_dev_get_from_minor()` instead of `comedi_dev_from_minor()`
to get the pointer to the `struct comedi_device`.  This increments the
reference to prevent it being freed.  Call `comedi_dev_put()` to
decrement the reference  on failure, and also call it from the 'release'
file operation handler `comedi_close()`.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
index 5e5ddbdbad0b39d1f4ff5310b50d6397c4b4f215..0ff69133c212885f5cbd570d2f1873b4f25c1a22 100644 (file)
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -2348,7 +2348,8 @@ out:
 static int comedi_open(struct inode *inode, struct file *file)
 {
        const unsigned minor = iminor(inode);
-       struct comedi_device *dev = comedi_dev_from_minor(minor);
+       struct comedi_device *dev = comedi_dev_get_from_minor(minor);
+       int rc;
 
        if (!dev) {
                DPRINTK("invalid minor number\n");
@@ -2373,8 +2374,8 @@ static int comedi_open(struct inode *inode, struct file *file)
                goto ok;
        if (!capable(CAP_NET_ADMIN) && dev->in_request_module) {
                DPRINTK("in request module\n");
-               mutex_unlock(&dev->mutex);
-               return -ENODEV;
+               rc = -ENODEV;
+               goto out;
        }
        if (capable(CAP_NET_ADMIN) && dev->in_request_module)
                goto ok;
@@ -2391,8 +2392,8 @@ static int comedi_open(struct inode *inode, struct file *file)
 
        if (!dev->attached && !capable(CAP_NET_ADMIN)) {
                DPRINTK("not attached and not CAP_NET_ADMIN\n");
-               mutex_unlock(&dev->mutex);
-               return -ENODEV;
+               rc = -ENODEV;
+               goto out;
        }
 ok:
        __module_get(THIS_MODULE);
@@ -2400,26 +2401,28 @@ ok:
        if (dev->attached) {
                if (!try_module_get(dev->driver->module)) {
                        module_put(THIS_MODULE);
-                       mutex_unlock(&dev->mutex);
-                       return -ENOSYS;
+                       rc = -ENOSYS;
+                       goto out;
                }
        }
 
        if (dev->attached && dev->use_count == 0 && dev->open) {
-               int rc = dev->open(dev);
+               rc = dev->open(dev);
                if (rc < 0) {
                        module_put(dev->driver->module);
                        module_put(THIS_MODULE);
-                       mutex_unlock(&dev->mutex);
-                       return rc;
+                       goto out;
                }
        }
 
        dev->use_count++;
+       rc = 0;
 
+out:
        mutex_unlock(&dev->mutex);
-
-       return 0;
+       if (rc)
+               comedi_dev_put(dev);
+       return rc;
 }
 
 static int comedi_fasync(int fd, struct file *file, int on)
@@ -2465,6 +2468,7 @@ static int comedi_close(struct inode *inode, struct file *file)
        dev->use_count--;
 
        mutex_unlock(&dev->mutex);
+       comedi_dev_put(dev);
 
        return 0;
 }