From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
alan@lxorguk.ukuu.org.uk,
Matthieu CASTET <matthieu.castet@parrot.com>,
Takashi Iwai <tiwai@suse.de>
Subject: [ 22/38] ALSA: Add a reference counter to card instance
Date: Wed, 14 Nov 2012 20:10:19 -0800 [thread overview]
Message-ID: <20121115040934.270136310@linuxfoundation.org> (raw)
In-Reply-To: <20121115040932.918082372@linuxfoundation.org>
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit a0830dbd4e42b38aefdf3fb61ba5019a1a99ea85 upstream.
For more strict protection for wild disconnections, a refcount is
introduced to the card instance, and let it up/down when an object is
referred via snd_lookup_*() in the open ops.
The free-after-last-close check is also changed to check this refcount
instead of the empty list, too.
Reported-by: Matthieu CASTET <matthieu.castet@parrot.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/sound/core.h | 3 ++
sound/core/control.c | 3 ++
sound/core/hwdep.c | 5 +++-
sound/core/init.c | 50 +++++++++++++++++++++++++++------------------
sound/core/oss/mixer_oss.c | 10 +++++++--
sound/core/oss/pcm_oss.c | 2 +
sound/core/pcm_native.c | 9 ++++++--
sound/core/rawmidi.c | 6 ++++-
sound/core/sound.c | 11 ++++++++-
sound/core/sound_oss.c | 10 +++++++--
10 files changed, 79 insertions(+), 30 deletions(-)
--- a/include/sound/core.h
+++ b/include/sound/core.h
@@ -132,6 +132,7 @@ struct snd_card {
int shutdown; /* this card is going down */
int free_on_last_close; /* free in context of file_release */
wait_queue_head_t shutdown_sleep;
+ atomic_t refcount; /* refcount for disconnection */
struct device *dev; /* device assigned to this card */
struct device *card_dev; /* cardX object for sysfs */
@@ -189,6 +190,7 @@ struct snd_minor {
const struct file_operations *f_ops; /* file operations */
void *private_data; /* private data for f_ops->open */
struct device *dev; /* device for sysfs */
+ struct snd_card *card_ptr; /* assigned card instance */
};
/* return a device pointer linked to each sound device as a parent */
@@ -295,6 +297,7 @@ int snd_card_info_done(void);
int snd_component_add(struct snd_card *card, const char *component);
int snd_card_file_add(struct snd_card *card, struct file *file);
int snd_card_file_remove(struct snd_card *card, struct file *file);
+void snd_card_unref(struct snd_card *card);
#define snd_card_set_dev(card, devptr) ((card)->dev = (devptr))
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -85,6 +85,7 @@ static int snd_ctl_open(struct inode *in
write_lock_irqsave(&card->ctl_files_rwlock, flags);
list_add_tail(&ctl->list, &card->ctl_files);
write_unlock_irqrestore(&card->ctl_files_rwlock, flags);
+ snd_card_unref(card);
return 0;
__error:
@@ -92,6 +93,8 @@ static int snd_ctl_open(struct inode *in
__error2:
snd_card_file_remove(card, file);
__error1:
+ if (card)
+ snd_card_unref(card);
return err;
}
--- a/sound/core/hwdep.c
+++ b/sound/core/hwdep.c
@@ -99,8 +99,10 @@ static int snd_hwdep_open(struct inode *
if (hw == NULL)
return -ENODEV;
- if (!try_module_get(hw->card->module))
+ if (!try_module_get(hw->card->module)) {
+ snd_card_unref(hw->card);
return -EFAULT;
+ }
init_waitqueue_entry(&wait, current);
add_wait_queue(&hw->open_wait, &wait);
@@ -147,6 +149,7 @@ static int snd_hwdep_open(struct inode *
mutex_unlock(&hw->open_mutex);
if (err < 0)
module_put(hw->card->module);
+ snd_card_unref(hw->card);
return err;
}
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -211,6 +211,7 @@ int snd_card_create(int idx, const char
spin_lock_init(&card->files_lock);
INIT_LIST_HEAD(&card->files_list);
init_waitqueue_head(&card->shutdown_sleep);
+ atomic_set(&card->refcount, 0);
#ifdef CONFIG_PM
mutex_init(&card->power_lock);
init_waitqueue_head(&card->power_sleep);
@@ -444,21 +445,36 @@ static int snd_card_do_free(struct snd_c
return 0;
}
+/**
+ * snd_card_unref - release the reference counter
+ * @card: the card instance
+ *
+ * Decrements the reference counter. When it reaches to zero, wake up
+ * the sleeper and call the destructor if needed.
+ */
+void snd_card_unref(struct snd_card *card)
+{
+ if (atomic_dec_and_test(&card->refcount)) {
+ wake_up(&card->shutdown_sleep);
+ if (card->free_on_last_close)
+ snd_card_do_free(card);
+ }
+}
+EXPORT_SYMBOL(snd_card_unref);
+
int snd_card_free_when_closed(struct snd_card *card)
{
- int free_now = 0;
- int ret = snd_card_disconnect(card);
- if (ret)
- return ret;
+ int ret;
- spin_lock(&card->files_lock);
- if (list_empty(&card->files_list))
- free_now = 1;
- else
- card->free_on_last_close = 1;
- spin_unlock(&card->files_lock);
+ atomic_inc(&card->refcount);
+ ret = snd_card_disconnect(card);
+ if (ret) {
+ atomic_dec(&card->refcount);
+ return ret;
+ }
- if (free_now)
+ card->free_on_last_close = 1;
+ if (atomic_dec_and_test(&card->refcount))
snd_card_do_free(card);
return 0;
}
@@ -472,7 +488,7 @@ int snd_card_free(struct snd_card *card)
return ret;
/* wait, until all devices are ready for the free operation */
- wait_event(card->shutdown_sleep, list_empty(&card->files_list));
+ wait_event(card->shutdown_sleep, !atomic_read(&card->refcount));
snd_card_do_free(card);
return 0;
}
@@ -853,6 +869,7 @@ int snd_card_file_add(struct snd_card *c
return -ENODEV;
}
list_add(&mfile->list, &card->files_list);
+ atomic_inc(&card->refcount);
spin_unlock(&card->files_lock);
return 0;
}
@@ -875,7 +892,6 @@ EXPORT_SYMBOL(snd_card_file_add);
int snd_card_file_remove(struct snd_card *card, struct file *file)
{
struct snd_monitor_file *mfile, *found = NULL;
- int last_close = 0;
spin_lock(&card->files_lock);
list_for_each_entry(mfile, &card->files_list, list) {
@@ -890,19 +906,13 @@ int snd_card_file_remove(struct snd_card
break;
}
}
- if (list_empty(&card->files_list))
- last_close = 1;
spin_unlock(&card->files_lock);
- if (last_close) {
- wake_up(&card->shutdown_sleep);
- if (card->free_on_last_close)
- snd_card_do_free(card);
- }
if (!found) {
snd_printk(KERN_ERR "ALSA card file remove problem (%p)\n", file);
return -ENOENT;
}
kfree(found);
+ snd_card_unref(card);
return 0;
}
--- a/sound/core/oss/mixer_oss.c
+++ b/sound/core/oss/mixer_oss.c
@@ -51,14 +51,19 @@ static int snd_mixer_oss_open(struct ino
SNDRV_OSS_DEVICE_TYPE_MIXER);
if (card == NULL)
return -ENODEV;
- if (card->mixer_oss == NULL)
+ if (card->mixer_oss == NULL) {
+ snd_card_unref(card);
return -ENODEV;
+ }
err = snd_card_file_add(card, file);
- if (err < 0)
+ if (err < 0) {
+ snd_card_unref(card);
return err;
+ }
fmixer = kzalloc(sizeof(*fmixer), GFP_KERNEL);
if (fmixer == NULL) {
snd_card_file_remove(card, file);
+ snd_card_unref(card);
return -ENOMEM;
}
fmixer->card = card;
@@ -67,6 +72,7 @@ static int snd_mixer_oss_open(struct ino
if (!try_module_get(card->module)) {
kfree(fmixer);
snd_card_file_remove(card, file);
+ snd_card_unref(card);
return -EFAULT;
}
return 0;
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -2457,6 +2457,8 @@ static int snd_pcm_oss_open(struct inode
__error2:
snd_card_file_remove(pcm->card, file);
__error1:
+ if (pcm)
+ snd_card_unref(pcm->card);
return err;
}
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -1627,6 +1627,7 @@ static int snd_pcm_link(struct snd_pcm_s
_end:
write_unlock_irq(&snd_pcm_link_rwlock);
up_write(&snd_pcm_link_rwsem);
+ snd_card_unref(substream1->pcm->card);
fput(file);
return res;
}
@@ -2104,7 +2105,9 @@ static int snd_pcm_playback_open(struct
return err;
pcm = snd_lookup_minor_data(iminor(inode),
SNDRV_DEVICE_TYPE_PCM_PLAYBACK);
- return snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_PLAYBACK);
+ err = snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_PLAYBACK);
+ snd_card_unref(pcm->card);
+ return err;
}
static int snd_pcm_capture_open(struct inode *inode, struct file *file)
@@ -2115,7 +2118,9 @@ static int snd_pcm_capture_open(struct i
return err;
pcm = snd_lookup_minor_data(iminor(inode),
SNDRV_DEVICE_TYPE_PCM_CAPTURE);
- return snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_CAPTURE);
+ err = snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_CAPTURE);
+ snd_card_unref(pcm->card);
+ return err;
}
static int snd_pcm_open(struct file *file, struct snd_pcm *pcm, int stream)
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -394,8 +394,10 @@ static int snd_rawmidi_open(struct inode
if (rmidi == NULL)
return -ENODEV;
- if (!try_module_get(rmidi->card->module))
+ if (!try_module_get(rmidi->card->module)) {
+ snd_card_unref(rmidi->card);
return -ENXIO;
+ }
mutex_lock(&rmidi->open_mutex);
card = rmidi->card;
@@ -455,6 +457,7 @@ static int snd_rawmidi_open(struct inode
#endif
file->private_data = rawmidi_file;
mutex_unlock(&rmidi->open_mutex);
+ snd_card_unref(rmidi->card);
return 0;
__error:
@@ -462,6 +465,7 @@ static int snd_rawmidi_open(struct inode
__error_card:
mutex_unlock(&rmidi->open_mutex);
module_put(rmidi->card->module);
+ snd_card_unref(rmidi->card);
return err;
}
--- a/sound/core/sound.c
+++ b/sound/core/sound.c
@@ -99,6 +99,10 @@ static void snd_request_other(int minor)
*
* Checks that a minor device with the specified type is registered, and returns
* its user data pointer.
+ *
+ * This function increments the reference counter of the card instance
+ * if an associated instance with the given minor number and type is found.
+ * The caller must call snd_card_unref() appropriately later.
*/
void *snd_lookup_minor_data(unsigned int minor, int type)
{
@@ -109,9 +113,11 @@ void *snd_lookup_minor_data(unsigned int
return NULL;
mutex_lock(&sound_mutex);
mreg = snd_minors[minor];
- if (mreg && mreg->type == type)
+ if (mreg && mreg->type == type) {
private_data = mreg->private_data;
- else
+ if (mreg->card_ptr)
+ atomic_inc(&mreg->card_ptr->refcount);
+ } else
private_data = NULL;
mutex_unlock(&sound_mutex);
return private_data;
@@ -275,6 +281,7 @@ int snd_register_device_for_dev(int type
preg->device = dev;
preg->f_ops = f_ops;
preg->private_data = private_data;
+ preg->card_ptr = card;
mutex_lock(&sound_mutex);
#ifdef CONFIG_SND_DYNAMIC_MINORS
minor = snd_find_free_minor(type);
--- a/sound/core/sound_oss.c
+++ b/sound/core/sound_oss.c
@@ -39,6 +39,9 @@
static struct snd_minor *snd_oss_minors[SNDRV_OSS_MINORS];
static DEFINE_MUTEX(sound_oss_mutex);
+/* NOTE: This function increments the refcount of the associated card like
+ * snd_lookup_minor_data(); the caller must call snd_card_unref() appropriately
+ */
void *snd_lookup_oss_minor_data(unsigned int minor, int type)
{
struct snd_minor *mreg;
@@ -48,9 +51,11 @@ void *snd_lookup_oss_minor_data(unsigned
return NULL;
mutex_lock(&sound_oss_mutex);
mreg = snd_oss_minors[minor];
- if (mreg && mreg->type == type)
+ if (mreg && mreg->type == type) {
private_data = mreg->private_data;
- else
+ if (mreg->card_ptr)
+ atomic_inc(&mreg->card_ptr->refcount);
+ } else
private_data = NULL;
mutex_unlock(&sound_oss_mutex);
return private_data;
@@ -122,6 +127,7 @@ int snd_register_oss_device(int type, st
preg->device = dev;
preg->f_ops = f_ops;
preg->private_data = private_data;
+ preg->card_ptr = card;
mutex_lock(&sound_oss_mutex);
snd_oss_minors[minor] = preg;
minor_unit = SNDRV_MINOR_OSS_DEVICE(minor);
next prev parent reply other threads:[~2012-11-15 4:46 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-11-15 4:09 [ 00/38] 3.0.52-stable review Greg Kroah-Hartman
2012-11-15 4:09 ` [ 01/38] ath9k: fix stale pointers potentially causing access to freed skbs Greg Kroah-Hartman
2012-11-15 4:09 ` [ 02/38] rt2800: validate step value for temperature compensation Greg Kroah-Hartman
2012-11-15 4:10 ` [ 03/38] target: Dont return success from module_init() if setup fails Greg Kroah-Hartman
2012-11-15 4:10 ` [ 04/38] cfg80211: fix antenna gain handling Greg Kroah-Hartman
2012-11-15 4:10 ` [ 05/38] wireless: drop invalid mesh address extension frames Greg Kroah-Hartman
2012-11-15 4:10 ` [ 06/38] mac80211: dont inspect Sequence Control field on control frames Greg Kroah-Hartman
2012-11-15 4:10 ` [ 07/38] DRM/Radeon: Fix Load Detection on legacy primary DAC Greg Kroah-Hartman
2012-11-15 4:10 ` [ 08/38] mac80211: check management frame header length Greg Kroah-Hartman
2012-11-15 4:10 ` [ 09/38] mac80211: fix SSID copy on IBSS JOIN Greg Kroah-Hartman
2012-11-15 4:10 ` [ 10/38] nfsv3: Make v3 mounts fail with ETIMEDOUTs instead EIO on mountd timeouts Greg Kroah-Hartman
2012-11-15 4:10 ` [ 11/38] nfs: Show original device name verbatim in /proc/*/mount{s,info} Greg Kroah-Hartman
2012-11-15 4:10 ` [ 12/38] NFSv4: nfs4_locku_done must release the sequence id Greg Kroah-Hartman
2012-11-15 4:10 ` [ 13/38] nfsd: add get_uint for u32s Greg Kroah-Hartman
2012-11-15 4:10 ` [ 14/38] NFS: fix bug in legacy DNS resolver Greg Kroah-Hartman
2012-11-15 4:10 ` [ 15/38] NFS: Fix Oopses in nfs_lookup_revalidate and nfs4_lookup_revalidate Greg Kroah-Hartman
2012-11-15 4:10 ` [ 16/38] drm: restore open_count if drm_setup fails Greg Kroah-Hartman
2012-11-15 4:10 ` [ 17/38] hwmon: (w83627ehf) Force initial bank selection Greg Kroah-Hartman
2012-11-15 4:10 ` [ 18/38] ALSA: PCM: Fix some races at disconnection Greg Kroah-Hartman
2012-11-15 4:10 ` [ 19/38] ALSA: usb-audio: Fix " Greg Kroah-Hartman
2012-11-15 4:10 ` [ 20/38] ALSA: usb-audio: Use rwsem for disconnect protection Greg Kroah-Hartman
2012-11-15 4:10 ` [ 21/38] ALSA: usb-audio: Fix races at disconnection in mixer_quirks.c Greg Kroah-Hartman
2012-11-15 4:10 ` Greg Kroah-Hartman [this message]
2012-11-15 4:10 ` [ 23/38] ALSA: Avoid endless sleep after disconnect Greg Kroah-Hartman
2012-11-15 4:10 ` [ 24/38] sctp: fix call to SCTP_CMD_PROCESS_SACK in sctp_cmd_interpreter() Greg Kroah-Hartman
2012-11-15 4:10 ` [ 25/38] netlink: use kfree_rcu() in netlink_release() Greg Kroah-Hartman
2012-11-15 4:10 ` [ 26/38] tcp: fix FIONREAD/SIOCINQ Greg Kroah-Hartman
2012-11-15 4:10 ` [ 27/38] ipv6: Set default hoplimit as zero Greg Kroah-Hartman
2012-11-15 4:10 ` [ 28/38] net: usb: Fix memory leak on Tx data path Greg Kroah-Hartman
2012-11-15 4:10 ` [ 29/38] net: fix divide by zero in tcp algorithm illinois Greg Kroah-Hartman
2012-11-15 4:10 ` [ 30/38] l2tp: fix oops in l2tp_eth_create() error path Greg Kroah-Hartman
2012-11-15 4:10 ` [ 31/38] ipv6: send unsolicited neighbour advertisements to all-nodes Greg Kroah-Hartman
2012-11-15 4:10 ` [ 32/38] futex: Handle futex_pi OWNER_DIED take over correctly Greg Kroah-Hartman
2012-11-15 4:10 ` [ 33/38] drm/vmwgfx: Fix hibernation device reset Greg Kroah-Hartman
2012-11-15 4:10 ` [ 34/38] drm/i915: fixup infoframe support for sdvo Greg Kroah-Hartman
2012-11-15 4:10 ` [ 35/38] drm/i915: clear the entire sdvo infoframe buffer Greg Kroah-Hartman
2012-11-15 4:10 ` [ 36/38] USB: mos7840: remove unused variable Greg Kroah-Hartman
2012-11-15 4:10 ` [ 37/38] xfs: fix reading of wrapped log data Greg Kroah-Hartman
2012-11-15 4:10 ` [ 38/38] intel-iommu: Fix AB-BA lockdep report Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121115040934.270136310@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=matthieu.castet@parrot.com \
--cc=stable@vger.kernel.org \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.