1 files changed, 32 insertions, 2 deletions

diff --git a/sound/core/timer.c b/sound/core/timer.c
index 9a6157ea6881..fc144f43faa6 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -35,6 +35,9 @@
 #include <sound/initval.h>
 #include <linux/kmod.h>
 
+/* internal flags */
+#define SNDRV_TIMER_IFLG_PAUSED         0x00010000
+
 #if IS_ENABLED(CONFIG_SND_HRTIMER)
 #define DEFAULT_TIMER_LIMIT 4
 #else
@@ -294,8 +297,21 @@ int snd_timer_open(struct snd_timer_instance **ti,
                 get_device(&timer->card->card_dev);
         timeri->slave_class = tid->dev_sclass;
         timeri->slave_id = slave_id;
-        if (list_empty(&timer->open_list_head) && timer->hw.open)
-                timer->hw.open(timer);
+
+        if (list_empty(&timer->open_list_head) && timer->hw.open) {
+                int err = timer->hw.open(timer);
+                if (err) {
+                        kfree(timeri->owner);
+                        kfree(timeri);
+
+                        if (timer->card)
+                                put_device(&timer->card->card_dev);
+                        module_put(timer->module);
+                        mutex_unlock(&register_mutex);
+                        return err;
+                }
+        }
+
         list_add_tail(&timeri->open_list, &timer->open_list_head);
         snd_timer_check_master(timeri);
         mutex_unlock(&register_mutex);
@@ -526,6 +542,10 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop)
                 }
         }
         timeri->flags &= ~(SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START);
+        if (stop)
+                timeri->flags &= ~SNDRV_TIMER_IFLG_PAUSED;
+        else
+                timeri->flags |= SNDRV_TIMER_IFLG_PAUSED;
         snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP :
                           SNDRV_TIMER_EVENT_CONTINUE);
  unlock:
@@ -587,6 +607,10 @@ int snd_timer_stop(struct snd_timer_instance *timeri)
  */
 int snd_timer_continue(struct snd_timer_instance *timeri)
 {
+        /* timer can continue only after pause */
+        if (!(timeri->flags & SNDRV_TIMER_IFLG_PAUSED))
+                return -EINVAL;
+
         if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE)
                 return snd_timer_start_slave(timeri, false);
         else
@@ -813,6 +837,7 @@ int snd_timer_new(struct snd_card *card, char *id, struct snd_timer_id *tid,
         timer->tmr_subdevice = tid->subdevice;
         if (id)
                 strlcpy(timer->id, id, sizeof(timer->id));
+        timer->sticks = 1;
         INIT_LIST_HEAD(&timer->device_list);
         INIT_LIST_HEAD(&timer->open_list_head);
         INIT_LIST_HEAD(&timer->active_list_head);
@@ -1817,6 +1842,9 @@ static int snd_timer_user_continue(struct file *file)
         tu = file->private_data;
         if (!tu->timeri)
                 return -EBADFD;
+        /* start timer instead of continue if it's not used before */
+        if (!(tu->timeri->flags & SNDRV_TIMER_IFLG_PAUSED))
+                return snd_timer_user_start(file);
         tu->timeri->lost = 0;
         return (err = snd_timer_continue(tu->timeri)) < 0 ? err : 0;
 }
@@ -1958,6 +1986,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
                 tu->qused--;
                 spin_unlock_irq(&tu->qlock);
 
+                mutex_lock(&tu->ioctl_lock);
                 if (tu->tread) {
                         if (copy_to_user(buffer, &tu->tqueue[qhead],
                                          sizeof(struct snd_timer_tread)))
@@ -1967,6 +1996,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
                                          sizeof(struct snd_timer_read)))
                                 err = -EFAULT;
                 }
+                mutex_unlock(&tu->ioctl_lock);
 
                 spin_lock_irq(&tu->qlock);
                 if (err < 0)