ALSA: Add a reference counter to card instance

For more strict protection for wild disconnections, a refcount is
introduced to the card instance, and let it up/down when an object is
referred via snd_lookup_*() in the open ops.

The free-after-last-close check is also changed to check this refcount
instead of the empty list, too.

Reported-by: Matthieu CASTET <matthieu.castet@parrot.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

1 files changed, 4 insertions, 1 deletions

diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c
index 75ea16f35b1a..53a6ba5ad615 100644
--- a/sound/core/hwdep.c
+++ b/sound/core/hwdep.c
@@ -100,8 +100,10 @@ static int snd_hwdep_open(struct inode *inode, struct file * file)
         if (hw == NULL)
                 return -ENODEV;
 
-        if (!try_module_get(hw->card->module))
+        if (!try_module_get(hw->card->module)) {
+                snd_card_unref(hw->card);
                 return -EFAULT;
+        }
 
         init_waitqueue_entry(&wait, current);
         add_wait_queue(&hw->open_wait, &wait);
@@ -148,6 +150,7 @@ static int snd_hwdep_open(struct inode *inode, struct file * file)
         mutex_unlock(&hw->open_mutex);
         if (err < 0)
                 module_put(hw->card->module);
+        snd_card_unref(hw->card);
         return err;
 }