Rewind v3.13-rc3+ (78fd82238d0e5716) to v3.12

1 files changed, 14 insertions, 3 deletions

diff --git a/sound/sound_core.c b/sound/sound_core.c
index 11e953a..45759f4 100644
--- a/sound/sound_core.c
+++ b/sound/sound_core.c
@@ -626,20 +626,31 @@ static int soundcore_open(struct inode *inode, struct file *file)
 		if (s)
 			new_fops = fops_get(s->unit_fops);
 	}
-	spin_unlock(&sound_loader_lock);
 	if (new_fops) {
 		/*
 		 * We rely upon the fact that we can't be unloaded while the
-		 * subdriver is there.
+		 * subdriver is there, so if ->open() is successful we can
+		 * safely drop the reference counter and if it is not we can
+		 * revert to old ->f_op. Ugly, indeed, but that's the cost of
+		 * switching ->f_op in the first place.
 		 */
 		int err = 0;
-		replace_fops(file, new_fops);
+		const struct file_operations *old_fops = file->f_op;
+		file->f_op = new_fops;
+		spin_unlock(&sound_loader_lock);
 
 		if (file->f_op->open)
 			err = file->f_op->open(inode,file);
 
+		if (err) {
+			fops_put(file->f_op);
+			file->f_op = fops_get(old_fops);
+		}
+
+		fops_put(old_fops);
 		return err;
 	}
+	spin_unlock(&sound_loader_lock);
 	return -ENODEV;
 }