[ALSA] snd_hwdep_release() racefix

snd_card_file_remove() can free the snd_card.
Touch hw->* only before calling snd_card_file_remove().
Unrelated: Allow hwdep devices not to have own ops.release();

Signed-off-by: Karsten Wiese <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>
Signed-off-by: Jaroslav Kysela <[email protected]>

diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c
index a6a6ad0ad3c81226746573f637086fff121aa05d..39c03f3dfbfa07d2a0dfed12ac5bf12480cfb8ac 100644 (file)
--- a/sound/core/hwdep.c
+++ b/sound/core/hwdep.c
@@ -156,15 +156,16 @@ static int snd_hwdep_release(struct inode *inode, struct file * file)
        int err = -ENXIO;
        struct snd_hwdep *hw = file->private_data;
        struct module *mod = hw->card->module;
+
        mutex_lock(&hw->open_mutex);
-       if (hw->ops.release) {
+       if (hw->ops.release)
                err = hw->ops.release(hw, file);
-               wake_up(&hw->open_wait);
-       }
        if (hw->used > 0)
                hw->used--;
-       snd_card_file_remove(hw->card, file);
        mutex_unlock(&hw->open_mutex);
+       wake_up(&hw->open_wait);
+
+       snd_card_file_remove(hw->card, file);
        module_put(mod);
        return err;
 }