ALSA: Add a reference counter to card instance

For more strict protection for wild disconnections, a refcount is
introduced to the card instance, and let it up/down when an object is
referred via snd_lookup_*() in the open ops.

The free-after-last-close check is also changed to check this refcount
instead of the empty list, too.

Reported-by: Matthieu CASTET <matthieu.castet@parrot.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

10 files changed, 83 insertions, 32 deletions

diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index c40ae573346d..ad11dc994792 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -100,12 +100,15 @@ static int snd_compr_open(struct inode *inode, struct file *f)
 
         if (dirn != compr->direction) {
                 pr_err("this device doesn't support this direction\n");
+                snd_card_unref(compr->card);
                 return -EINVAL;
         }
 
         data = kzalloc(sizeof(*data), GFP_KERNEL);
-        if (!data)
+        if (!data) {
+                snd_card_unref(compr->card);
                 return -ENOMEM;
+        }
         data->stream.ops = compr->ops;
         data->stream.direction = dirn;
         data->stream.private_data = compr->private_data;
@@ -113,6 +116,7 @@ static int snd_compr_open(struct inode *inode, struct file *f)
         runtime = kzalloc(sizeof(*runtime), GFP_KERNEL);
         if (!runtime) {
                 kfree(data);
+                snd_card_unref(compr->card);
                 return -ENOMEM;
         }
         runtime->state = SNDRV_PCM_STATE_OPEN;
@@ -126,7 +130,8 @@ static int snd_compr_open(struct inode *inode, struct file *f)
                 kfree(runtime);
                 kfree(data);
         }
-        return ret;
+        snd_card_unref(compr->card);
+        return 0;
 }
 
 static int snd_compr_free(struct inode *inode, struct file *f)
diff --git a/sound/core/control.c b/sound/core/control.c
index 7e86a5b9f3b5..9768a3963c8f 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -86,6 +86,7 @@ static int snd_ctl_open(struct inode *inode, struct file *file)
         write_lock_irqsave(&card->ctl_files_rwlock, flags);
         list_add_tail(&ctl->list, &card->ctl_files);
         write_unlock_irqrestore(&card->ctl_files_rwlock, flags);
+        snd_card_unref(card);
         return 0;
 
       __error:
@@ -93,6 +94,8 @@ static int snd_ctl_open(struct inode *inode, struct file *file)
       __error2:
         snd_card_file_remove(card, file);
       __error1:
+        if (card)
+                snd_card_unref(card);
         return err;
 }
 
diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c
index 75ea16f35b1a..53a6ba5ad615 100644
--- a/sound/core/hwdep.c
+++ b/sound/core/hwdep.c
@@ -100,8 +100,10 @@ static int snd_hwdep_open(struct inode *inode, struct file * file)
         if (hw == NULL)
                 return -ENODEV;
 
-        if (!try_module_get(hw->card->module))
+        if (!try_module_get(hw->card->module)) {
+                snd_card_unref(hw->card);
                 return -EFAULT;
+        }
 
         init_waitqueue_entry(&wait, current);
         add_wait_queue(&hw->open_wait, &wait);
@@ -148,6 +150,7 @@ static int snd_hwdep_open(struct inode *inode, struct file * file)
         mutex_unlock(&hw->open_mutex);
         if (err < 0)
                 module_put(hw->card->module);
+        snd_card_unref(hw->card);
         return err;
 }
 
diff --git a/sound/core/init.c b/sound/core/init.c
index d8ec849af128..7b012d15c2cf 100644
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -213,6 +213,7 @@ int snd_card_create(int idx, const char *xid,
         spin_lock_init(&card->files_lock);
         INIT_LIST_HEAD(&card->files_list);
         init_waitqueue_head(&card->shutdown_sleep);
+        atomic_set(&card->refcount, 0);
 #ifdef CONFIG_PM
         mutex_init(&card->power_lock);
         init_waitqueue_head(&card->power_sleep);
@@ -446,21 +447,36 @@ static int snd_card_do_free(struct snd_card *card)
         return 0;
 }
 
+/**
+ * snd_card_unref - release the reference counter
+ * @card: the card instance
+ *
+ * Decrements the reference counter.  When it reaches to zero, wake up
+ * the sleeper and call the destructor if needed.
+ */
+void snd_card_unref(struct snd_card *card)
+{
+        if (atomic_dec_and_test(&card->refcount)) {
+                wake_up(&card->shutdown_sleep);
+                if (card->free_on_last_close)
+                        snd_card_do_free(card);
+        }
+}
+EXPORT_SYMBOL(snd_card_unref);
+
 int snd_card_free_when_closed(struct snd_card *card)
 {
-        int free_now = 0;
-        int ret = snd_card_disconnect(card);
-        if (ret)
-                return ret;
+        int ret;
 
-        spin_lock(&card->files_lock);
-        if (list_empty(&card->files_list))
-                free_now = 1;
-        else
-                card->free_on_last_close = 1;
-        spin_unlock(&card->files_lock);
+        atomic_inc(&card->refcount);
+        ret = snd_card_disconnect(card);
+        if (ret) {
+                atomic_dec(&card->refcount);
+                return ret;
+        }
 
-        if (free_now)
+        card->free_on_last_close = 1;
+        if (atomic_dec_and_test(&card->refcount))
                 snd_card_do_free(card);
         return 0;
 }
@@ -474,7 +490,7 @@ int snd_card_free(struct snd_card *card)
                 return ret;
 
         /* wait, until all devices are ready for the free operation */
-        wait_event(card->shutdown_sleep, list_empty(&card->files_list));
+        wait_event(card->shutdown_sleep, !atomic_read(&card->refcount));
         snd_card_do_free(card);
         return 0;
 }
@@ -886,6 +902,7 @@ int snd_card_file_add(struct snd_card *card, struct file *file)
                 return -ENODEV;
         }
         list_add(&mfile->list, &card->files_list);
+        atomic_inc(&card->refcount);
         spin_unlock(&card->files_lock);
         return 0;
 }
@@ -908,7 +925,6 @@ EXPORT_SYMBOL(snd_card_file_add);
 int snd_card_file_remove(struct snd_card *card, struct file *file)
 {
         struct snd_monitor_file *mfile, *found = NULL;
-        int last_close = 0;
 
         spin_lock(&card->files_lock);
         list_for_each_entry(mfile, &card->files_list, list) {