wl1251: fix a memory leak in probe

[safe/jmp/linux-2.6] / kernel / module.c

diff --git a/kernel/module.c b/kernel/module.c
index e7a6e53..e256458 100644 (file)
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -59,8 +59,6 @@
 #define CREATE_TRACE_POINTS
 #include <trace/events/module.h>
 
-EXPORT_TRACEPOINT_SYMBOL(module_get);
-
 #if 0
 #define DEBUGP printk
 #else
@@ -415,6 +413,40 @@ static void percpu_modcopy(struct module *mod,
                memcpy(per_cpu_ptr(mod->percpu, cpu), from, size);
 }
 
+/**
+ * is_module_percpu_address - test whether address is from module static percpu
+ * @addr: address to test
+ *
+ * Test whether @addr belongs to module static percpu area.
+ *
+ * RETURNS:
+ * %true if @addr is from module static percpu area
+ */
+bool is_module_percpu_address(unsigned long addr)
+{
+       struct module *mod;
+       unsigned int cpu;
+
+       preempt_disable();
+
+       list_for_each_entry_rcu(mod, &modules, list) {
+               if (!mod->percpu_size)
+                       continue;
+               for_each_possible_cpu(cpu) {
+                       void *start = per_cpu_ptr(mod->percpu, cpu);
+
+                       if ((void *)addr >= start &&
+                           (void *)addr < start + mod->percpu_size) {
+                               preempt_enable();
+                               return true;
+                       }
+               }
+       }
+
+       preempt_enable();
+       return false;
+}
+
 #else /* ... !CONFIG_SMP */
 
 static inline void __percpu *mod_percpu(struct module *mod)
@@ -441,6 +473,10 @@ static inline void percpu_modcopy(struct module *mod,
        /* pcpusec should be 0, and size of that section should be 0. */
        BUG_ON(size != 0);
 }
+bool is_module_percpu_address(unsigned long addr)
+{
+       return false;
+}
 
 #endif /* CONFIG_SMP */
 
@@ -477,17 +513,22 @@ MODINFO_ATTR(srcversion);
 static char last_unloaded_module[MODULE_NAME_LEN+1];
 
 #ifdef CONFIG_MODULE_UNLOAD
+
+EXPORT_TRACEPOINT_SYMBOL(module_get);
+
 /* Init the unload section of the module. */
 static void module_unload_init(struct module *mod)
 {
        int cpu;
 
        INIT_LIST_HEAD(&mod->modules_which_use_me);
-       for_each_possible_cpu(cpu)
-               per_cpu_ptr(mod->refptr, cpu)->count = 0;
+       for_each_possible_cpu(cpu) {
+               per_cpu_ptr(mod->refptr, cpu)->incs = 0;
+               per_cpu_ptr(mod->refptr, cpu)->decs = 0;
+       }
 
        /* Hold reference count during initialization. */
-       __this_cpu_write(mod->refptr->count, 1);
+       __this_cpu_write(mod->refptr->incs, 1);
        /* Backwards compatibility macros put refcount during init. */
        mod->waiter = current;
 }
@@ -626,12 +667,28 @@ static int try_stop_module(struct module *mod, int flags, int *forced)
 
 unsigned int module_refcount(struct module *mod)
 {
-       unsigned int total = 0;
+       unsigned int incs = 0, decs = 0;
        int cpu;
 
        for_each_possible_cpu(cpu)
-               total += per_cpu_ptr(mod->refptr, cpu)->count;
-       return total;
+               decs += per_cpu_ptr(mod->refptr, cpu)->decs;
+       /*
+        * ensure the incs are added up after the decs.
+        * module_put ensures incs are visible before decs with smp_wmb.
+        *
+        * This 2-count scheme avoids the situation where the refcount
+        * for CPU0 is read, then CPU0 increments the module refcount,
+        * then CPU1 drops that refcount, then the refcount for CPU1 is
+        * read. We would record a decrement but not its corresponding
+        * increment so we would see a low count (disaster).
+        *
+        * Rare situation? But module_refcount can be preempted, and we
+        * might be tallying up 4096+ CPUs. So it is not impossible.
+        */
+       smp_rmb();
+       for_each_possible_cpu(cpu)
+               incs += per_cpu_ptr(mod->refptr, cpu)->incs;
+       return incs - decs;
 }
 EXPORT_SYMBOL(module_refcount);
 
@@ -667,16 +724,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
                return -EFAULT;
        name[MODULE_NAME_LEN-1] = '\0';
 
-       /* Create stop_machine threads since free_module relies on
-        * a non-failing stop_machine call. */
-       ret = stop_machine_create();
-       if (ret)
-               return ret;
-
-       if (mutex_lock_interruptible(&module_mutex) != 0) {
-               ret = -EINTR;
-               goto out_stop;
-       }
+       if (mutex_lock_interruptible(&module_mutex) != 0)
+               return -EINTR;
 
        mod = find_module(name);
        if (!mod) {
@@ -736,8 +785,6 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
 
  out:
        mutex_unlock(&module_mutex);
-out_stop:
-       stop_machine_destroy();
        return ret;
 }
 
@@ -808,10 +855,10 @@ void module_put(struct module *module)
 {
        if (module) {
                preempt_disable();
-               __this_cpu_dec(module->refptr->count);
+               smp_wmb(); /* see comment in module_refcount */
+               __this_cpu_inc(module->refptr->decs);
 
-               trace_module_put(module, _RET_IP_,
-                                __this_cpu_read(module->refptr->count));
+               trace_module_put(module, _RET_IP_);
                /* Maybe they're waiting for us to drop reference? */
                if (unlikely(!module_is_live(module)))
                        wake_up_process(module->waiter);