[PATCH master 2/3] fs: devfs: restore cdev reference count maintenance

[Ahmad Fatoum <a.fatoum@pengutronix.de>]

barebox v2024.03.0 moves the reference count maintenance into
cdev_open/cdev_close, but missed to switch devfs_open and devfs_close to
actually use cdev_open/cdev_close. The result was that the cdev could be
deleted, e.g. due to partition reparsing, and further use of the file
descriptor would result in a use-after-free.

Fix this by doing what the commit introducing the breakage was purported
to do.

Fixes: d84c3daf1314 ("fs: move cdev open count to cdev_open()/cdev_close()")
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 fs/devfs.c | 18 ++----------------
 1 file changed, 2 insertions(+), 16 deletions(-)

diff --git a/fs/devfs.c b/fs/devfs.c
index c8ddbbdab04d..f5bad5aa9bf2 100644
--- a/fs/devfs.c
+++ b/fs/devfs.c
@@ -102,33 +102,19 @@ static int devfs_open(struct device *_dev, FILE *f, const char *filename)
 	struct inode *inode = f->f_inode;
 	struct devfs_inode *node = container_of(inode, struct devfs_inode, inode);
 	struct cdev *cdev = node->cdev;
-	int ret;
 
 	f->size = cdev->flags & DEVFS_IS_CHARACTER_DEV ?
 			FILE_SIZE_STREAM : cdev->size;
 	f->priv = cdev;
 
-	if (cdev->ops->open) {
-		ret = cdev->ops->open(cdev, f->flags);
-		if (ret)
-			return ret;
-	}
-
-	return 0;
+	return cdev_open(cdev, f->flags);
 }
 
 static int devfs_close(struct device *_dev, FILE *f)
 {
 	struct cdev *cdev = f->priv;
-	int ret;
 
-	if (cdev->ops->close) {
-		ret = cdev->ops->close(cdev);
-		if (ret)
-			return ret;
-	}
-
-	return 0;
+	return cdev_close(cdev);
 }
 
 static int devfs_flush(struct device *_dev, FILE *f)
-- 
2.39.2