ALSA: Add a reference counter to card instance

For more strict protection for wild disconnections, a refcount is
introduced to the card instance, and let it up/down when an object is
referred via snd_lookup_*() in the open ops.

The free-after-last-close check is also changed to check this refcount
instead of the empty list, too.

Reported-by: Matthieu CASTET <matthieu.castet@parrot.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

1 files changed, 7 insertions, 2 deletions

diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 8753c89f3290..48c6a70ad69e 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -1642,6 +1642,7 @@ static int snd_pcm_link(struct snd_pcm_substream *substream, int fd)
         write_unlock_irq(&snd_pcm_link_rwlock);
         up_write(&snd_pcm_link_rwsem);
  _nolock:
+        snd_card_unref(substream1->pcm->card);
         fput_light(file, fput_needed);
         if (res < 0)
                 kfree(group);
@@ -2116,7 +2117,9 @@ static int snd_pcm_playback_open(struct inode *inode, struct file *file)
                 return err;
         pcm = snd_lookup_minor_data(iminor(inode),
                                     SNDRV_DEVICE_TYPE_PCM_PLAYBACK);
-        return snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_PLAYBACK);
+        err = snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_PLAYBACK);
+        snd_card_unref(pcm->card);
+        return err;
 }
 
 static int snd_pcm_capture_open(struct inode *inode, struct file *file)
@@ -2127,7 +2130,9 @@ static int snd_pcm_capture_open(struct inode *inode, struct file *file)
                 return err;
         pcm = snd_lookup_minor_data(iminor(inode),
                                     SNDRV_DEVICE_TYPE_PCM_CAPTURE);
-        return snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_CAPTURE);
+        err = snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_CAPTURE);
+        snd_card_unref(pcm->card);
+        return err;
 }
 
 static int snd_pcm_open(struct file *file, struct snd_pcm *pcm, int stream)