ALSA: Add a reference counter to card instance

For more strict protection for wild disconnections, a refcount is introduced to the card instance, and let it up/down when an object is referred via snd_lookup_*() in the open ops. The free-after-last-close check is also changed to check this refcount instead of the empty list, too.

Takashi Iwai committed 14 years ago

Commit a0830db1 parent 888ea7d11 files · +86 −32Browse files

Unified · Split

11 files

include/sound/core.h +3 −0
sound/core/compress_offload.c +7 −2
sound/core/control.c +3 −0
sound/core/hwdep.c +4 −1
sound/core/init.c +30 −20
sound/core/oss/mixer_oss.c +8 −2
sound/core/oss/pcm_oss.c +2 −0
sound/core/pcm_native.c +7 −2
sound/core/rawmidi.c +5 −1
sound/core/sound.c +9 −2
sound/core/sound_oss.c +8 −2

include/sound/core.h+3−0

@@ -132,6 +132,7 @@ struct snd_card { · 131 unmodified lines
132	132	int shutdown; /* this card is going down */
133	133	int free_on_last_close; /* free in context of file_release */
134	134	wait_queue_head_t shutdown_sleep;
	135	+ atomic_t refcount; /* refcount for disconnection */
135	136	struct device dev; / device assigned to this card */
136	137	struct device card_dev; / cardX object for sysfs */
137	138
@@ -189,6 +190,7 @@ struct snd_minor { · 51 unmodified lines
189	190	const struct file_operations f_ops; / file operations */
190	191	void private_data; / private data for f_ops->open */
191	192	struct device dev; / device for sysfs */
	193	+ struct snd_card card_ptr; / assigned card instance */
192	194	};
193	195
194	196	/* return a device pointer linked to each sound device as a parent */
@@ -295,6 +297,7 @@ int snd_card_info_done(void); · 100 unmodified lines
295	297	int snd_component_add(struct snd_card card, const char component);
296	298	int snd_card_file_add(struct snd_card card, struct file file);
297	299	int snd_card_file_remove(struct snd_card card, struct file file);
	300	+void snd_card_unref(struct snd_card *card);
298	301
299	302	#define snd_card_set_dev(card, devptr) ((card)->dev = (devptr))
300	303

sound/core/compress_offload.c+7−2

@@ -100,12 +100,15 @@ static int snd_compr_open(struct inode inode, struct file f) · 99 unmodified lines
100	100
101	101	if (dirn != compr->direction) {
102	102	pr_err("this device doesn't support this direction\n");
	103	+ snd_card_unref(compr->card);
103	104	return -EINVAL;
104	105	}
105	106
106	107	data = kzalloc(sizeof(*data), GFP_KERNEL);
107		− if (!data)
	108	+ if (!data) {
	109	+ snd_card_unref(compr->card);
108	110	return -ENOMEM;
	111	+ }
109	112	data->stream.ops = compr->ops;
110	113	data->stream.direction = dirn;
111	114	data->stream.private_data = compr->private_data;
@@ -113,6 +116,7 @@ static int snd_compr_open(struct inode inode, struct file f) · 1 unmodified line
113	116	runtime = kzalloc(sizeof(*runtime), GFP_KERNEL);
114	117	if (!runtime) {
115	118	kfree(data);
	119	+ snd_card_unref(compr->card);
116	120	return -ENOMEM;
117	121	}
118	122	runtime->state = SNDRV_PCM_STATE_OPEN;
@@ -126,7 +130,8 @@ static int snd_compr_open(struct inode inode, struct file f) · 7 unmodified lines
126	130	kfree(runtime);
127	131	kfree(data);
128	132	}
129		− return ret;
	133	+ snd_card_unref(compr->card);
	134	+ return 0;
130	135	}
131	136
132	137	static int snd_compr_free(struct inode inode, struct file f)

sound/core/control.c+3−0

@@ -86,6 +86,7 @@ static int snd_ctl_open(struct inode inode, struct file file) · 85 unmodified lines
86	86	write_lock_irqsave(&card->ctl_files_rwlock, flags);
87	87	list_add_tail(&ctl->list, &card->ctl_files);
88	88	write_unlock_irqrestore(&card->ctl_files_rwlock, flags);
	89	+ snd_card_unref(card);
89	90	return 0;
90	91
91	92	__error:
@@ -93,6 +94,8 @@ static int snd_ctl_open(struct inode inode, struct file file) · 1 unmodified line
93	94	__error2:
94	95	snd_card_file_remove(card, file);
95	96	__error1:
	97	+ if (card)
	98	+ snd_card_unref(card);
96	99	return err;
97	100	}
98	101

sound/core/hwdep.c+4−1

@@ -100,8 +100,10 @@ static int snd_hwdep_open(struct inode inode, struct file file) · 99 unmodified lines
100	100	if (hw == NULL)
101	101	return -ENODEV;
102	102
103		− if (!try_module_get(hw->card->module))
	103	+ if (!try_module_get(hw->card->module)) {
	104	+ snd_card_unref(hw->card);
104	105	return -EFAULT;
	106	+ }
105	107
106	108	init_waitqueue_entry(&wait, current);
107	109	add_wait_queue(&hw->open_wait, &wait);
@@ -148,6 +150,7 @@ static int snd_hwdep_open(struct inode inode, struct file file) · 40 unmodified lines
148	150	mutex_unlock(&hw->open_mutex);
149	151	if (err < 0)
150	152	module_put(hw->card->module);
	153	+ snd_card_unref(hw->card);
151	154	return err;
152	155	}
153	156

sound/core/init.c+30−20

@@ -213,6 +213,7 @@ int snd_card_create(int idx, const char *xid, · 212 unmodified lines
213	213	spin_lock_init(&card->files_lock);
214	214	INIT_LIST_HEAD(&card->files_list);
215	215	init_waitqueue_head(&card->shutdown_sleep);
	216	+ atomic_set(&card->refcount, 0);
216	217	#ifdef CONFIG_PM
217	218	mutex_init(&card->power_lock);
218	219	init_waitqueue_head(&card->power_sleep);
@@ -446,21 +447,36 @@ static int snd_card_do_free(struct snd_card *card) · 227 unmodified lines
446	447	return 0;
447	448	}
448	449
	450	+/**
	451	+ * snd_card_unref - release the reference counter
	452	+ * @card: the card instance
	453	+ *
	454	+ * Decrements the reference counter. When it reaches to zero, wake up
	455	+ * the sleeper and call the destructor if needed.
	456	+ */
	457	+void snd_card_unref(struct snd_card *card)
	458	+{
	459	+ if (atomic_dec_and_test(&card->refcount)) {
	460	+ wake_up(&card->shutdown_sleep);
	461	+ if (card->free_on_last_close)
	462	+ snd_card_do_free(card);
	463	+ }
	464	+}
	465	+EXPORT_SYMBOL(snd_card_unref);
	466	+
449	467	int snd_card_free_when_closed(struct snd_card *card)
450	468	{
451		− int free_now = 0;
452		− int ret = snd_card_disconnect(card);
453		− if (ret)
454		− return ret;
	469	+ int ret;
455	470
456		− spin_lock(&card->files_lock);
457		− if (list_empty(&card->files_list))
458		− free_now = 1;
459		− else
460		− card->free_on_last_close = 1;
461		− spin_unlock(&card->files_lock);
	471	+ atomic_inc(&card->refcount);
	472	+ ret = snd_card_disconnect(card);
	473	+ if (ret) {
	474	+ atomic_dec(&card->refcount);
	475	+ return ret;
	476	+ }
462	477
463		− if (free_now)
	478	+ card->free_on_last_close = 1;
	479	+ if (atomic_dec_and_test(&card->refcount))
464	480	snd_card_do_free(card);
465	481	return 0;
466	482	}
@@ -474,7 +490,7 @@ int snd_card_free(struct snd_card *card) · 7 unmodified lines
474	490	return ret;
475	491
476	492	/* wait, until all devices are ready for the free operation */
477		− wait_event(card->shutdown_sleep, list_empty(&card->files_list));
	493	+ wait_event(card->shutdown_sleep, !atomic_read(&card->refcount));
478	494	snd_card_do_free(card);
479	495	return 0;
480	496	}
@@ -886,6 +902,7 @@ int snd_card_file_add(struct snd_card card, struct file file) · 405 unmodified lines
886	902	return -ENODEV;
887	903	}
888	904	list_add(&mfile->list, &card->files_list);
	905	+ atomic_inc(&card->refcount);
889	906	spin_unlock(&card->files_lock);
890	907	return 0;
891	908	}
@@ -908,7 +925,6 @@ EXPORT_SYMBOL(snd_card_file_add); · 16 unmodified lines
908	925	int snd_card_file_remove(struct snd_card card, struct file file)
909	926	{
910	927	struct snd_monitor_file mfile, found = NULL;
911		− int last_close = 0;
912	928
913	929	spin_lock(&card->files_lock);
914	930	list_for_each_entry(mfile, &card->files_list, list) {
@@ -923,19 +939,13 @@ int snd_card_file_remove(struct snd_card card, struct file file) · 8 unmodified lines
923	939	break;
924	940	}
925	941	}
926		− if (list_empty(&card->files_list))
927		− last_close = 1;
928	942	spin_unlock(&card->files_lock);
929		− if (last_close) {
930		− wake_up(&card->shutdown_sleep);
931		− if (card->free_on_last_close)
932		− snd_card_do_free(card);
933		− }
934	943	if (!found) {
935	944	snd_printk(KERN_ERR "ALSA card file remove problem (%p)\n", file);
936	945	return -ENOENT;
937	946	}
938	947	kfree(found);
	948	+ snd_card_unref(card);
939	949	return 0;
940	950	}
941	951

sound/core/oss/mixer_oss.c+8−2

@@ -52,14 +52,19 @@ static int snd_mixer_oss_open(struct inode inode, struct file file) · 51 unmodified lines
52	52	SNDRV_OSS_DEVICE_TYPE_MIXER);
53	53	if (card == NULL)
54	54	return -ENODEV;
55		− if (card->mixer_oss == NULL)
	55	+ if (card->mixer_oss == NULL) {
	56	+ snd_card_unref(card);
56	57	return -ENODEV;
	58	+ }
57	59	err = snd_card_file_add(card, file);
58		− if (err < 0)
	60	+ if (err < 0) {
	61	+ snd_card_unref(card);
59	62	return err;
	63	+ }
60	64	fmixer = kzalloc(sizeof(*fmixer), GFP_KERNEL);
61	65	if (fmixer == NULL) {
62	66	snd_card_file_remove(card, file);
	67	+ snd_card_unref(card);
63	68	return -ENOMEM;
64	69	}
65	70	fmixer->card = card;
@@ -68,6 +73,7 @@ static int snd_mixer_oss_open(struct inode inode, struct file file) · 2 unmodified lines
68	73	if (!try_module_get(card->module)) {
69	74	kfree(fmixer);
70	75	snd_card_file_remove(card, file);
	76	+ snd_card_unref(card);
71	77	return -EFAULT;
72	78	}
73	79	return 0;

sound/core/oss/pcm_oss.c+2−0

@@ -2457,6 +2457,8 @@ static int snd_pcm_oss_open(struct inode inode, struct file file) · 2456 unmodified lines
2457	2457	__error2:
2458	2458	snd_card_file_remove(pcm->card, file);
2459	2459	__error1:
	2460	+ if (pcm)
	2461	+ snd_card_unref(pcm->card);
2460	2462	return err;
2461	2463	}
2462	2464

sound/core/pcm_native.c+7−2

@@ -1642,6 +1642,7 @@ static int snd_pcm_link(struct snd_pcm_substream *substream, int fd) · 1641 unmodified lines
1642	1642	write_unlock_irq(&snd_pcm_link_rwlock);
1643	1643	up_write(&snd_pcm_link_rwsem);
1644	1644	_nolock:
	1645	+ snd_card_unref(substream1->pcm->card);
1645	1646	fput_light(file, fput_needed);
1646	1647	if (res < 0)
1647	1648	kfree(group);
@@ -2116,7 +2117,9 @@ static int snd_pcm_playback_open(struct inode inode, struct file file) · 468 unmodified lines
2116	2117	return err;
2117	2118	pcm = snd_lookup_minor_data(iminor(inode),
2118	2119	SNDRV_DEVICE_TYPE_PCM_PLAYBACK);
2119		− return snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_PLAYBACK);
	2120	+ err = snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_PLAYBACK);
	2121	+ snd_card_unref(pcm->card);
	2122	+ return err;
2120	2123	}
2121	2124
2122	2125	static int snd_pcm_capture_open(struct inode inode, struct file file)
@@ -2127,7 +2130,9 @@ static int snd_pcm_capture_open(struct inode inode, struct file file) · 4 unmodified lines
2127	2130	return err;
2128	2131	pcm = snd_lookup_minor_data(iminor(inode),
2129	2132	SNDRV_DEVICE_TYPE_PCM_CAPTURE);
2130		− return snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_CAPTURE);
	2133	+ err = snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_CAPTURE);
	2134	+ snd_card_unref(pcm->card);
	2135	+ return err;
2131	2136	}
2132	2137
2133	2138	static int snd_pcm_open(struct file file, struct snd_pcm pcm, int stream)

sound/core/rawmidi.c+5−1

@@ -379,8 +379,10 @@ static int snd_rawmidi_open(struct inode inode, struct file file) · 378 unmodified lines
379	379	if (rmidi == NULL)
380	380	return -ENODEV;
381	381
382		− if (!try_module_get(rmidi->card->module))
	382	+ if (!try_module_get(rmidi->card->module)) {
	383	+ snd_card_unref(rmidi->card);
383	384	return -ENXIO;
	385	+ }
384	386
385	387	mutex_lock(&rmidi->open_mutex);
386	388	card = rmidi->card;
@@ -440,6 +442,7 @@ static int snd_rawmidi_open(struct inode inode, struct file file) · 53 unmodified lines
440	442	#endif
441	443	file->private_data = rawmidi_file;
442	444	mutex_unlock(&rmidi->open_mutex);
	445	+ snd_card_unref(rmidi->card);
443	446	return 0;
444	447
445	448	__error:
@@ -447,6 +450,7 @@ static int snd_rawmidi_open(struct inode inode, struct file file) · 1 unmodified line
447	450	__error_card:
448	451	mutex_unlock(&rmidi->open_mutex);
449	452	module_put(rmidi->card->module);
	453	+ snd_card_unref(rmidi->card);
450	454	return err;
451	455	}
452	456

sound/core/sound.c+9−2

@@ -98,6 +98,10 @@ static void snd_request_other(int minor) · 97 unmodified lines
98	98	*
99	99	* Checks that a minor device with the specified type is registered, and returns
100	100	* its user data pointer.
	101	+ *
	102	+ * This function increments the reference counter of the card instance
	103	+ * if an associated instance with the given minor number and type is found.
	104	+ * The caller must call snd_card_unref() appropriately later.
101	105	*/
102	106	void *snd_lookup_minor_data(unsigned int minor, int type)
103	107	{
@@ -108,9 +112,11 @@ void *snd_lookup_minor_data(unsigned int minor, int type) · 4 unmodified lines
108	112	return NULL;
109	113	mutex_lock(&sound_mutex);
110	114	mreg = snd_minors[minor];
111		− if (mreg && mreg->type == type)
	115	+ if (mreg && mreg->type == type) {
112	116	private_data = mreg->private_data;
113		− else
	117	+ if (mreg->card_ptr)
	118	+ atomic_inc(&mreg->card_ptr->refcount);
	119	+ } else
114	120	private_data = NULL;
115	121	mutex_unlock(&sound_mutex);
116	122	return private_data;
@@ -275,6 +281,7 @@ int snd_register_device_for_dev(int type, struct snd_card *card, int dev, · 158 unmodified lines
275	281	preg->device = dev;
276	282	preg->f_ops = f_ops;
277	283	preg->private_data = private_data;
	284	+ preg->card_ptr = card;
278	285	mutex_lock(&sound_mutex);
279	286	#ifdef CONFIG_SND_DYNAMIC_MINORS
280	287	minor = snd_find_free_minor(type);

sound/core/sound_oss.c+8−2

@@ -40,6 +40,9 @@ · 39 unmodified lines
40	40	static struct snd_minor *snd_oss_minors[SNDRV_OSS_MINORS];
41	41	static DEFINE_MUTEX(sound_oss_mutex);
42	42
	43	+/* NOTE: This function increments the refcount of the associated card like
	44	+ * snd_lookup_minor_data(); the caller must call snd_card_unref() appropriately
	45	+ */
43	46	void *snd_lookup_oss_minor_data(unsigned int minor, int type)
44	47	{
45	48	struct snd_minor *mreg;
@@ -49,9 +52,11 @@ void *snd_lookup_oss_minor_data(unsigned int minor, int type) · 3 unmodified lines
49	52	return NULL;
50	53	mutex_lock(&sound_oss_mutex);
51	54	mreg = snd_oss_minors[minor];
52		− if (mreg && mreg->type == type)
	55	+ if (mreg && mreg->type == type) {
53	56	private_data = mreg->private_data;
54		− else
	57	+ if (mreg->card_ptr)
	58	+ atomic_inc(&mreg->card_ptr->refcount);
	59	+ } else
55	60	private_data = NULL;
56	61	mutex_unlock(&sound_oss_mutex);
57	62	return private_data;
@@ -123,6 +128,7 @@ int snd_register_oss_device(int type, struct snd_card *card, int dev, · 65 unmodified lines
123	128	preg->device = dev;
124	129	preg->f_ops = f_ops;
125	130	preg->private_data = private_data;
	131	+ preg->card_ptr = card;
126	132	mutex_lock(&sound_oss_mutex);
127	133	snd_oss_minors[minor] = preg;
128	134	minor_unit = SNDRV_MINOR_OSS_DEVICE(minor);