snd_ctl_rename() expects that card->controls_rwsem is held in the
caller side for avoiding possible races, but actually no one really
did that. It's likely because this operation is done usually only at
the device initialization where no race can happen. But, it's still
safer to take a lock, so we just take the lock inside snd_ctl_rename()
like most of other API functions do.
Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
---
sound/core/control.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/sound/core/control.c b/sound/core/control.c
index 8386b53acdcd..a41d19c46df2 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -769,11 +769,12 @@ EXPORT_SYMBOL(snd_ctl_rename_id);
*
* Renames the specified control on the card to the new name.
*
- * Make sure to take the control write lock - down_write(&card->controls_rwsem).
+ * Note that this function takes card->controls_rwsem lock internally.
*/
void snd_ctl_rename(struct snd_card *card, struct snd_kcontrol *kctl,
const char *name)
{
+ down_write(&card->controls_rwsem);
remove_hash_entries(card, kctl);
if (strscpy(kctl->id.name, name, sizeof(kctl->id.name)) < 0)
@@ -781,6 +782,7 @@ void snd_ctl_rename(struct snd_card *card, struct snd_kcontrol *kctl,
name, kctl->id.name);
add_hash_entries(card, kctl);
+ up_write(&card->controls_rwsem);
}
EXPORT_SYMBOL(snd_ctl_rename);
--
2.35.3
