[PATCH v2] nvmem: core: balance the layout module ref in nvmem_cell_get_from_lookup()

[Yu Zhang]

nvmem_cell_put() unconditionally calls nvmem_layout_module_put(), which
does module_put() on the layout driver module when nvmem->layout is set.
of_nvmem_cell_get() balances that with nvmem_layout_module_get_optional(),
but nvmem_cell_get_from_lookup() - the non-DT lookup-table path - does
not take the reference.

A consumer that resolves a cell of a layout-backed nvmem device through a
cell lookup table therefore drops a layout-module reference it never
took. That underflows the layout driver's module refcount and can let the
module be unloaded while still referenced.

Take the layout module reference on the lookup path as well, releasing it
on the error paths, mirroring of_nvmem_cell_get().

Signed-off-by: Yu Zhang <yuz08559@xxxxxxxxx>
---
v2: nvmem_layout_module_get_optional() was defined inside the
    CONFIG_OF block, but the new call site in
    nvmem_cell_get_from_lookup() is compiled unconditionally, so v1
    broke the build on CONFIG_OF=n ("used but never defined",
    reported by the kernel test robot). Move the helper out of the
    CONFIG_OF block, next to its already-unconditional sibling
    nvmem_layout_module_put(); it references no OF-specific symbols.
    The v1 fix itself is unchanged.
    Closes: https://lore.kernel.org/oe-kbuild-all/202610271703.wiO2VfuK-lkp@xxxxxxxxx/
    Closes: https://lore.kernel.org/oe-kbuild-all/202610271602.GRxskiKw-lkp@xxxxxxxxx/

 drivers/nvmem/core.c | 38 +++++++++++++++++++++++++-------------
 1 file changed, 25 insertions(+), 13 deletions(-)

diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 7d4cce8..fc26e2c 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -1324,6 +1324,9 @@ static struct nvmem_cell *nvmem_create_cell(struct nvmem_cell_entry *entry,
 	return cell;
 }
 
+static int nvmem_layout_module_get_optional(struct nvmem_device *nvmem);
+static void nvmem_layout_module_put(struct nvmem_device *nvmem);
+
 static struct nvmem_cell *
 nvmem_cell_get_from_lookup(struct device *dev, const char *con_id)
 {
@@ -1350,15 +1353,24 @@ nvmem_cell_get_from_lookup(struct device *dev, const char *con_id)
 				/* Provider may not be registered yet. */
 				return ERR_CAST(nvmem);
 
+			if (nvmem_layout_module_get_optional(nvmem)) {
+				nvmem_device_put(nvmem);
+				cell = ERR_PTR(-EPROBE_DEFER);
+				break;
+			}
+
 			cell_entry = nvmem_find_cell_entry_by_name(nvmem,
 								   lookup->cell_name);
 			if (!cell_entry) {
+				nvmem_layout_module_put(nvmem);
 				nvmem_device_put(nvmem);
 				cell = ERR_PTR(-ENOENT);
 			} else {
 				cell = nvmem_create_cell(cell_entry, con_id, 0);
-				if (IS_ERR(cell))
+				if (IS_ERR(cell)) {
+					nvmem_layout_module_put(nvmem);
 					nvmem_device_put(nvmem);
+				}
 			}
 			break;
 		}
@@ -1373,6 +1385,18 @@ static void nvmem_layout_module_put(struct nvmem_device *nvmem)
 		module_put(nvmem->layout->dev.driver->owner);
 }
 
+static int nvmem_layout_module_get_optional(struct nvmem_device *nvmem)
+{
+	if (!nvmem->layout)
+		return 0;
+
+	if (!nvmem->layout->dev.driver ||
+	    !try_module_get(nvmem->layout->dev.driver->owner))
+		return -EPROBE_DEFER;
+
+	return 0;
+}
+
 #if IS_ENABLED(CONFIG_OF)
 static struct nvmem_cell_entry *
 nvmem_find_cell_entry_by_node(struct nvmem_device *nvmem, struct device_node *np)
@@ -1389,18 +1413,6 @@ nvmem_find_cell_entry_by_node(struct nvmem_device *nvmem, struct device_node *np
 	return NULL;
 }
 
-static int nvmem_layout_module_get_optional(struct nvmem_device *nvmem)
-{
-	if (!nvmem->layout)
-		return 0;
-
-	if (!nvmem->layout->dev.driver ||
-	    !try_module_get(nvmem->layout->dev.driver->owner))
-		return -EPROBE_DEFER;
-
-	return 0;
-}
-
 /**
  * of_nvmem_cell_get() - Get a nvmem cell from given device node and cell id
  *
-- 
2.55.0