commit f9d202833d0beac09ef1c6a41305151da4fe5d4c
author Takashi Iwai <tiwai@suse.de> Wed Feb 11 14:55:59 2009 +0100
committer Takashi Iwai <tiwai@suse.de> Mon Mar 09 15:17:21 2009 +0100
tree 4bd6b75853a5bad34fb17d95afa33b1e3f4997bb
parent fec6c6fec3e20637bee5d276fb61dd8b49a3f9cc

ALSA: rawmidi - Fix possible race in open

The module refcount should be handled in the register_mutex to avoid
possible races with module unloading.

Signed-off-by: Takashi Iwai <tiwai@suse.de>

sound/core/rawmidi.c

diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index 002777b..60f33e9 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -237,15 +237,16 @@
 		rfile->input = rfile->output = NULL;
 	mutex_lock(&register_mutex);
 	rmidi = snd_rawmidi_search(card, device);
-	mutex_unlock(&register_mutex);
 	if (rmidi == NULL) {
-		err = -ENODEV;
-		goto __error1;
+		mutex_unlock(&register_mutex);
+		return -ENODEV;
 	}
 	if (!try_module_get(rmidi->card->module)) {
-		err = -EFAULT;
-		goto __error1;
+		mutex_unlock(&register_mutex);
+		return -ENXIO;
 	}
+	mutex_unlock(&register_mutex);
+
 	if (!(mode & SNDRV_RAWMIDI_LFLG_NOOPENLOCK))
 		mutex_lock(&rmidi->open_mutex);
 	if (mode & SNDRV_RAWMIDI_LFLG_INPUT) {
@@ -370,10 +371,9 @@
 		snd_rawmidi_runtime_free(sinput);
 	if (output != NULL)
 		snd_rawmidi_runtime_free(soutput);
-	module_put(rmidi->card->module);
 	if (!(mode & SNDRV_RAWMIDI_LFLG_NOOPENLOCK))
 		mutex_unlock(&rmidi->open_mutex);
-      __error1:
+	module_put(rmidi->card->module);
 	return err;
 }