[PATCH] nvmem: core: balance the layout module ref in nvmem_cell_get_from_lookup()

[Yu Zhang]

nvmem_cell_put() unconditionally calls nvmem_layout_module_put(), which
does module_put() on the layout driver module when nvmem->layout is set.
of_nvmem_cell_get() balances that with nvmem_layout_module_get_optional(),
but nvmem_cell_get_from_lookup() - the non-DT lookup-table path - does
not take the reference.

A consumer that resolves a cell of a layout-backed nvmem device through a
cell lookup table therefore drops a layout-module reference it never
took. That underflows the layout driver's module refcount and can let the
module be unloaded while still referenced.

Take the layout module reference on the lookup path as well, releasing it
on the error paths, mirroring of_nvmem_cell_get().

Signed-off-by: Yu Zhang <yuz08559@xxxxxxxxx>
---
 drivers/nvmem/core.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 7d4cce8..34ec7d6 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -1324,6 +1324,9 @@ static struct nvmem_cell *nvmem_create_cell(struct nvmem_cell_entry *entry,
 	return cell;
 }
 
+static int nvmem_layout_module_get_optional(struct nvmem_device *nvmem);
+static void nvmem_layout_module_put(struct nvmem_device *nvmem);
+
 static struct nvmem_cell *
 nvmem_cell_get_from_lookup(struct device *dev, const char *con_id)
 {
@@ -1350,15 +1353,24 @@ nvmem_cell_get_from_lookup(struct device *dev, const char *con_id)
 				/* Provider may not be registered yet. */
 				return ERR_CAST(nvmem);
 
+			if (nvmem_layout_module_get_optional(nvmem)) {
+				nvmem_device_put(nvmem);
+				cell = ERR_PTR(-EPROBE_DEFER);
+				break;
+			}
+
 			cell_entry = nvmem_find_cell_entry_by_name(nvmem,
 								   lookup->cell_name);
 			if (!cell_entry) {
+				nvmem_layout_module_put(nvmem);
 				nvmem_device_put(nvmem);
 				cell = ERR_PTR(-ENOENT);
 			} else {
 				cell = nvmem_create_cell(cell_entry, con_id, 0);
-				if (IS_ERR(cell))
+				if (IS_ERR(cell)) {
+					nvmem_layout_module_put(nvmem);
 					nvmem_device_put(nvmem);
+				}
 			}
 			break;
 		}
-- 
2.43.0