[PATCH] more bogus MOD_INC_USE_COUNT removals

 - example in Documentation/DocBook/procfs_example.c uses
   MOD_..._USE_COUNT for no reason.

 - alpha/kernel/srm_env.c uses MOD_...USE_COUNT for no reason _and_ does
   lovely stuff like strlen() on user-supplied pointers,
   copy_from_user() with unverified size, half-kilobyte on-stack arrays,
   etc.  Fixed.

 - s390{,x}/kernel/debug.c: set ->owner instead of playing with
   MOD_..._USE_COUNT in ->open()/->release()

 - mwavedd.c: gratitious use of MOD_..._USE_COUNT

 - uinput.c: ditto

 - radio/miropcm20-rds.c: set ->owner, remove MOD_..._USE_COUNT from
   ->open()/->release(), fixed an obvious race in the former (it checked
   that nobody else had device opened, then did kmalloc() with
   GFP_KERNEL, then marked device as opened).

Documentation/DocBook/procfs_example.c

@@ -75,13 +75,9 @@ static int proc_read_jiffies(char *page, char **start,
 {
 	int len;
 
-	MOD_INC_USE_COUNT;
-	
 	len = sprintf(page, "jiffies = %ld\n",
                       jiffies);
 
-	MOD_DEC_USE_COUNT;
-
 	return len;
 }
 
@@ -93,13 +89,10 @@ static int proc_read_foobar(char *page, char **start,
 	int len;
 	struct fb_data_t *fb_data = (struct fb_data_t *)data;
 
-	MOD_INC_USE_COUNT;
-	
+	/* DON'T DO THAT - buffer overruns are bad */
 	len = sprintf(page, "%s = '%s'\n", 
 		      fb_data->name, fb_data->value);
 
-	MOD_DEC_USE_COUNT;
-
 	return len;
 }
 
@@ -112,22 +105,16 @@ static int proc_write_foobar(struct file *file,
 	int len;
 	struct fb_data_t *fb_data = (struct fb_data_t *)data;
 
-	MOD_INC_USE_COUNT;
-
 	if(count > FOOBAR_LEN)
 		len = FOOBAR_LEN;
 	else
 		len = count;
 
-	if(copy_from_user(fb_data->value, buffer, len)) {
-		MOD_DEC_USE_COUNT;
+	if(copy_from_user(fb_data->value, buffer, len))
 		return -EFAULT;
-	}
 
 	fb_data->value[len] = '\0';
 
-	MOD_DEC_USE_COUNT;
-
 	return len;
 }
 

arch/alpha/kernel/srm_env.c

@@ -116,12 +116,8 @@ srm_env_read(char *page, char **start, off_t off, int count, int *eof,
 	unsigned long	ret;
 	srm_env_t	*entry;
 
-	MOD_INC_USE_COUNT;
-
-	if(off != 0) {
-		MOD_DEC_USE_COUNT;
+	if(off != 0)
 		return -EFAULT;
-	}
 
 	entry	= (srm_env_t *) data;
 	ret	= callback_getenv(entry->id, page, count);
@@ -131,8 +127,6 @@ srm_env_read(char *page, char **start, off_t off, int count, int *eof,
 	else
 		nbytes = -EFAULT;
 
-	MOD_DEC_USE_COUNT;
-
 	return nbytes;
 }
 
@@ -141,45 +135,38 @@ static int
 srm_env_write(struct file *file, const char *buffer, unsigned long count,
 		void *data)
 {
-#define BUFLEN	512
-	int		nbytes;
+	int res;
 	srm_env_t	*entry;
-	char		buf[BUFLEN];
+	char		*buf = (char *) __get_free_page(GFP_USER);
 	unsigned long	ret1, ret2;
 
-	MOD_INC_USE_COUNT;
-
 	entry = (srm_env_t *) data;
 
-	nbytes = strlen(buffer) + 1;
-	if(nbytes > BUFLEN) {
-		MOD_DEC_USE_COUNT;
+	if (!buf)
 		return -ENOMEM;
-	}
 
-	/* memcpy(aligned_buffer, buffer, nbytes) */
+	res = -EINVAL;
+	if (count >= PAGE_SIZE)
+		goto out;
 
-	if(copy_from_user(buf, buffer, count)) {
-		MOD_DEC_USE_COUNT;
-		return -EFAULT;
-	}
-	buf[count] = 0x00;
+	res = -EFAULT;
+	if (copy_from_user(buf, buffer, count))
+		goto out;
+	buf[count] = '\0';
 
 	ret1 = callback_setenv(entry->id, buf, count);
-	if((ret1 >> 61) == 0) {
+	if ((ret1 >> 61) == 0) {
 		do 
 			ret2 = callback_save_env();
 		while((ret2 >> 61) == 1);
-		nbytes = (int) ret1;
-	} else
-		nbytes = -EFAULT;
+		res = (int) ret1;
+	}
 
-	MOD_DEC_USE_COUNT;
+	free_page((unsigned long)buf);
 
-	return nbytes;
+	return res;
 }
 
-
 static void
 srm_env_cleanup(void)
 {

arch/s390/kernel/debug.c

@@ -150,6 +150,7 @@ DECLARE_MUTEX(debug_lock);
 static int initialized;
 
 static struct file_operations debug_file_ops = {
+	.owner	 = THIS_MODULE,
 	.read    = debug_output,
 	.write   = debug_input,	
 	.open    = debug_open,
@@ -497,7 +498,6 @@ static int debug_open(struct inode *inode, struct file *file)
 #ifdef DEBUG
 	printk("debug_open\n");
 #endif
-	MOD_INC_USE_COUNT;
 	down(&debug_lock);
 
 	/* find debug log and view */
@@ -554,8 +554,6 @@ static int debug_open(struct inode *inode, struct file *file)
 
       out:
 	up(&debug_lock);
-	if (rc != 0)
-		MOD_DEC_USE_COUNT;
 	return rc;
 }
 
@@ -575,7 +573,6 @@ static int debug_close(struct inode *inode, struct file *file)
 	debug_info_free(p_info->debug_info_snap);
 	debug_info_put(p_info->debug_info_org);
 	kfree(file->private_data);
-	MOD_DEC_USE_COUNT;
 	return 0;		/* success */
 }
 

arch/s390x/kernel/debug.c

@@ -150,6 +150,7 @@ DECLARE_MUTEX(debug_lock);
 static int initialized;
 
 static struct file_operations debug_file_ops = {
+	.owner	 = THIS_MODULE,
 	.read    = debug_output,
 	.write   = debug_input,	
 	.open    = debug_open,
@@ -497,7 +498,6 @@ static int debug_open(struct inode *inode, struct file *file)
 #ifdef DEBUG
 	printk("debug_open\n");
 #endif
-	MOD_INC_USE_COUNT;
 	down(&debug_lock);
 
 	/* find debug log and view */
@@ -554,8 +554,6 @@ static int debug_open(struct inode *inode, struct file *file)
 
       out:
 	up(&debug_lock);
-	if (rc != 0)
-		MOD_DEC_USE_COUNT;
 	return rc;
 }
 
@@ -575,7 +573,6 @@ static int debug_close(struct inode *inode, struct file *file)
 	debug_info_free(p_info->debug_info_snap);
 	debug_info_put(p_info->debug_info_org);
 	kfree(file->private_data);
-	MOD_DEC_USE_COUNT;
 	return 0;		/* success */
 }
 

drivers/char/mwave/mwavedd.c

@@ -126,7 +126,6 @@ static int mwave_open(struct inode *inode, struct file *file)
 	PRINTK_2(TRACE_MWAVE,
 		"mwavedd::mwave_open, exit return retval %x\n", retval);
 
-	MOD_INC_USE_COUNT;
 	return retval;
 }
 
@@ -141,7 +140,6 @@ static int mwave_close(struct inode *inode, struct file *file)
 	PRINTK_2(TRACE_MWAVE, "mwavedd::mwave_close, exit retval %x\n",
 		retval);
 
-	MOD_DEC_USE_COUNT;
 	return retval;
 }
 

drivers/input/misc/uinput.c

@@ -111,8 +111,6 @@ static int uinput_open(struct inode *inode, struct file *file)
 	struct uinput_device	*newdev;
 	struct input_dev	*newinput;
 
-	MOD_INC_USE_COUNT;
-
 	newdev = kmalloc(sizeof(struct uinput_device), GFP_KERNEL);
 	if (!newdev)
 		goto error;
@@ -131,7 +129,6 @@ static int uinput_open(struct inode *inode, struct file *file)
 cleanup:
 	kfree(newdev);
 error:
-	MOD_DEC_USE_COUNT;
 	return -ENOMEM;
 }
 
@@ -296,11 +293,7 @@ static int uinput_burn_device(struct uinput_device *udev)
 
 static int uinput_close(struct inode *inode, struct file *file)
 {
-	int	retval;
-
-	retval = uinput_burn_device((struct uinput_device *)file->private_data);
-	MOD_DEC_USE_COUNT;
-	return retval;
+	return uinput_burn_device((struct uinput_device *)file->private_data);
 }
 
 static int uinput_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)

drivers/media/radio/miropcm20-rds.c

@@ -23,16 +23,16 @@ static int rds_users = 0;
 
 static int rds_f_open(struct inode *in, struct file *fi)
 {
-	if(rds_users)
+	if (rds_users)
 		return -EBUSY;
 
+	rds_users++;
 	if ((text_buffer=kmalloc(66, GFP_KERNEL)) == 0) {
+		rds_users--;
 		printk(KERN_NOTICE "aci-rds: Out of memory by open()...\n");
 		return -ENOMEM;
 	}
 
-	rds_users++;
-	MOD_INC_USE_COUNT;
 	return 0;
 }
 
@@ -41,7 +41,6 @@ static int rds_f_release(struct inode *in, struct file *fi)
 	kfree(text_buffer);
 
 	rds_users--;
-	MOD_DEC_USE_COUNT;
 	return 0;
 }
 
@@ -106,6 +105,7 @@ static ssize_t rds_f_read(struct file *file, char *buffer, size_t length, loff_t
 }
 
 static struct file_operations rds_f_ops = {
+	owner:	THIS_MODULE,
 	read:    rds_f_read,
 	open:    rds_f_open,
 	release: rds_f_release