ALSA: Fix card refcount unbalance

There are uncovered cases whether the card refcount introduced by the
commit a0830dbd isn't properly increased or decreased:
- OSS PCM and mixer success paths
- When lookup function gets NULL

This patch fixes these places.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=50251

Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

5 files changed, 8 insertions, 4 deletions

diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c
index a9a2e63c0222..e8a1d18774b2 100644
--- a/sound/core/oss/mixer_oss.c
+++ b/sound/core/oss/mixer_oss.c
@@ -76,6 +76,7 @@ static int snd_mixer_oss_open(struct inode *inode, struct file *file)
                 snd_card_unref(card);
                 return -EFAULT;
         }
+        snd_card_unref(card);
         return 0;
 }
 
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index f337b66a020b..4c1cc51772e6 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -2454,6 +2454,7 @@ static int snd_pcm_oss_open(struct inode *inode, struct file *file)
         mutex_unlock(&pcm->open_mutex);
         if (err < 0)
                 goto __error;
+        snd_card_unref(pcm->card);
         return err;
 
       __error:
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 6e8872de5ba0..f9ddecf2f4cd 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -2122,7 +2122,8 @@ static int snd_pcm_playback_open(struct inode *inode, struct file *file)
         pcm = snd_lookup_minor_data(iminor(inode),
                                     SNDRV_DEVICE_TYPE_PCM_PLAYBACK);
         err = snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_PLAYBACK);
-        snd_card_unref(pcm->card);
+        if (pcm)
+                snd_card_unref(pcm->card);
         return err;
 }
 
@@ -2135,7 +2136,8 @@ static int snd_pcm_capture_open(struct inode *inode, struct file *file)
         pcm = snd_lookup_minor_data(iminor(inode),
                                     SNDRV_DEVICE_TYPE_PCM_CAPTURE);
         err = snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_CAPTURE);
-        snd_card_unref(pcm->card);
+        if (pcm)
+                snd_card_unref(pcm->card);
         return err;
 }
 
diff --git a/sound/core/sound.c b/sound/core/sound.c
index 89780c323f19..70ccdab74153 100644
--- a/sound/core/sound.c
+++ b/sound/core/sound.c
@@ -114,7 +114,7 @@ void *snd_lookup_minor_data(unsigned int minor, int type)
         mreg = snd_minors[minor];
         if (mreg && mreg->type == type) {
                 private_data = mreg->private_data;
-                if (mreg->card_ptr)
+                if (private_data && mreg->card_ptr)
                         atomic_inc(&mreg->card_ptr->refcount);
         } else
                 private_data = NULL;
diff --git a/sound/core/sound_oss.c b/sound/core/sound_oss.c
index e1d79ee35906..726a49ac9725 100644
--- a/sound/core/sound_oss.c
+++ b/sound/core/sound_oss.c
@@ -54,7 +54,7 @@ void *snd_lookup_oss_minor_data(unsigned int minor, int type)
         mreg = snd_oss_minors[minor];
         if (mreg && mreg->type == type) {
                 private_data = mreg->private_data;
-                if (mreg->card_ptr)
+                if (private_data && mreg->card_ptr)
                         atomic_inc(&mreg->card_ptr->refcount);
         } else
                 private_data = NULL;