[PKT_SCHED]: Resolve race condition with module unload in qdisc_create()

This patch resolves the race condition with module unload
in qdisc_create by moving try_module_get up to the first
qdisc_lookup_ops call.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@redhat.com>

net/sched/sch_api.c

@@ -407,6 +407,9 @@ qdisc_create(struct net_device *dev, u32 handle, struct rtattr **tca, int *errp)
 	err = -EINVAL;
 	if (ops == NULL)
 		goto err_out;
+	err = -EBUSY;
+	if (!try_module_get(ops->owner))
+		goto err_out;
 
 	/* ensure that the Qdisc and the private data are 32-byte aligned */
 	size = ((sizeof(*sch) + QDISC_ALIGN_CONST) & ~QDISC_ALIGN_CONST);
@@ -415,18 +418,12 @@ qdisc_create(struct net_device *dev, u32 handle, struct rtattr **tca, int *errp)
 	p = kmalloc(size, GFP_KERNEL);
 	err = -ENOBUFS;
 	if (!p)
-		goto err_out;
+		goto err_out2;
 	memset(p, 0, size);
 	sch = (struct Qdisc *)(((unsigned long)p + QDISC_ALIGN_CONST)
 	                       & ~QDISC_ALIGN_CONST);
 	sch->padded = (char *)sch - (char *)p;
 
-	/* Grrr... Resolve race condition with module unload */
-
-	err = -EINVAL;
-	if (ops != qdisc_lookup_ops(kind))
-		goto err_out;
-
 	INIT_LIST_HEAD(&sch->list);
 	skb_queue_head_init(&sch->q);
 
@@ -444,7 +441,7 @@ qdisc_create(struct net_device *dev, u32 handle, struct rtattr **tca, int *errp)
 		handle = qdisc_alloc_handle(dev);
 		err = -ENOMEM;
 		if (handle == 0)
-			goto err_out;
+			goto err_out2;
 	}
 
 	if (handle == TC_H_INGRESS)
@@ -452,10 +449,6 @@ qdisc_create(struct net_device *dev, u32 handle, struct rtattr **tca, int *errp)
         else
                 sch->handle = handle;
 
-	err = -EBUSY;
-	if (!try_module_get(ops->owner))
-		goto err_out;
-
 	/* enqueue is accessed locklessly - make sure it's visible
 	 * before we set a netdevice's qdisc pointer to sch */
 	smp_wmb();
@@ -471,8 +464,8 @@ qdisc_create(struct net_device *dev, u32 handle, struct rtattr **tca, int *errp)
 #endif
 		return sch;
 	}
+err_out2:
 	module_put(ops->owner);
-
 err_out:
 	*errp = err;
 	if (p)