ALSA: Fix card refcount unbalance

commit 8bb4d9ce08b0a92ca174e41d92c180328f86173f upstream.

There are uncovered cases whether the card refcount introduced by the
commit a0830dbd isn't properly increased or decreased:
- OSS PCM and mixer success paths
- When lookup function gets NULL

This patch fixes these places.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=50251

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c
index 05395aaeaa32a4790b3a214d49977bd7499c07ad..c353768854e6b0e839fb96c294d36c483bf282af 100644 (file)
--- a/sound/core/oss/mixer_oss.c
+++ b/sound/core/oss/mixer_oss.c
@@ -76,6 +76,7 @@ static int snd_mixer_oss_open(struct inode *inode, struct file *file)
                snd_card_unref(card);
                return -EFAULT;
        }
+       snd_card_unref(card);
        return 0;
 }
 

diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index f337b66a020b5bbbfbf15c6730c2ec0143bfd11b..4c1cc51772e6f18e9ab03671069c738471ca8c04 100644 (file)
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -2454,6 +2454,7 @@ static int snd_pcm_oss_open(struct inode *inode, struct file *file)
        mutex_unlock(&pcm->open_mutex);
        if (err < 0)
                goto __error;
+       snd_card_unref(pcm->card);
        return err;
 
       __error:

diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 0844444eb100db21bea3013001f706a9382eb915..d535b341aa8276a523b879c7f4960cb3c9a557fc 100644 (file)
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -2111,7 +2111,8 @@ static int snd_pcm_playback_open(struct inode *inode, struct file *file)
        pcm = snd_lookup_minor_data(iminor(inode),
                                    SNDRV_DEVICE_TYPE_PCM_PLAYBACK);
        err = snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_PLAYBACK);
-       snd_card_unref(pcm->card);
+       if (pcm)
+               snd_card_unref(pcm->card);
        return err;
 }
 
@@ -2124,7 +2125,8 @@ static int snd_pcm_capture_open(struct inode *inode, struct file *file)
        pcm = snd_lookup_minor_data(iminor(inode),
                                    SNDRV_DEVICE_TYPE_PCM_CAPTURE);
        err = snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_CAPTURE);
-       snd_card_unref(pcm->card);
+       if (pcm)
+               snd_card_unref(pcm->card);
        return err;
 }
 

diff --git a/sound/core/sound.c b/sound/core/sound.c
index 7c0640eeee521d06fa04036941afab5db480a057..3700d96fb3fb51cc577dd63dc7cac498595a878f 100644 (file)
--- a/sound/core/sound.c
+++ b/sound/core/sound.c
@@ -115,7 +115,7 @@ void *snd_lookup_minor_data(unsigned int minor, int type)
        mreg = snd_minors[minor];
        if (mreg && mreg->type == type) {
                private_data = mreg->private_data;
-               if (mreg->card_ptr)
+               if (private_data && mreg->card_ptr)
                        atomic_inc(&mreg->card_ptr->refcount);
        } else
                private_data = NULL;

diff --git a/sound/core/sound_oss.c b/sound/core/sound_oss.c
index 7442c7ac2469f3b304d0ee40e8c5f002201cd4f3..ec86009141d0ba1bc43c366107c52b43cbf80ce1 100644 (file)
--- a/sound/core/sound_oss.c
+++ b/sound/core/sound_oss.c
@@ -54,7 +54,7 @@ void *snd_lookup_oss_minor_data(unsigned int minor, int type)
        mreg = snd_oss_minors[minor];
        if (mreg && mreg->type == type) {
                private_data = mreg->private_data;
-               if (mreg->card_ptr)
+               if (private_data && mreg->card_ptr)
                        atomic_inc(&mreg->card_ptr->refcount);
        } else
                private_data = NULL;