diff options
| author | Giuliano Pochini <pochini@shiny.it> | 2006-11-06 13:42:00 +0300 |
|---|---|---|
| committer | Jaroslav Kysela <perex@suse.cz> | 2007-01-09 11:06:13 +0300 |
| commit | 5929546a96d55962bdcabae0c4e25dfcd9f1fda9 (patch) | |
| tree | e3aa538bda1d3b836cf4c9e3a9784f8639aef642 /sound/pci | |
| parent | 5b005a0126bc2a2be3ae2c333d56e91bd5e2d8a6 (diff) | |
| download | linux-5929546a96d55962bdcabae0c4e25dfcd9f1fda9.tar.xz | |
[ALSA] Fix potential NULL pointer dereference in echoaudio midi
Fix races between the timer handler and the close function.
Signed-off-by: Giuliano Pochini <pochini@shiny.it>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Diffstat (limited to 'sound/pci')
| -rw-r--r-- | sound/pci/echoaudio/midi.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/sound/pci/echoaudio/midi.c b/sound/pci/echoaudio/midi.c index e31f0f11e3a8..91f5bff66d3f 100644 --- a/sound/pci/echoaudio/midi.c +++ b/sound/pci/echoaudio/midi.c @@ -213,7 +213,7 @@ static void snd_echo_midi_output_write(unsigned long data) sent = bytes = 0; spin_lock_irqsave(&chip->lock, flags); chip->midi_full = 0; - if (chip->midi_out && !snd_rawmidi_transmit_empty(chip->midi_out)) { + if (!snd_rawmidi_transmit_empty(chip->midi_out)) { bytes = snd_rawmidi_transmit_peek(chip->midi_out, buf, MIDI_OUT_BUFFER_SIZE - 1); DE_MID(("Try to send %d bytes...\n", bytes)); @@ -264,9 +264,11 @@ static void snd_echo_midi_output_trigger(struct snd_rawmidi_substream *substream } } else { if (chip->tinuse) { - del_timer(&chip->timer); chip->tinuse = 0; + spin_unlock_irq(&chip->lock); + del_timer_sync(&chip->timer); DE_MID(("Timer removed\n")); + return; } } spin_unlock_irq(&chip->lock); |