summaryrefslogtreecommitdiff
path: root/sound
diff options
context:
space:
mode:
authorGiuliano Pochini <pochini@shiny.it>2006-11-06 11:42:00 +0100
committerJaroslav Kysela <perex@suse.cz>2007-01-09 09:06:13 +0100
commit5929546a96d55962bdcabae0c4e25dfcd9f1fda9 (patch)
treee3aa538bda1d3b836cf4c9e3a9784f8639aef642 /sound
parent5b005a0126bc2a2be3ae2c333d56e91bd5e2d8a6 (diff)
[ALSA] Fix potential NULL pointer dereference in echoaudio midi
Fix races between the timer handler and the close function. Signed-off-by: Giuliano Pochini <pochini@shiny.it> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Diffstat (limited to 'sound')
-rw-r--r--sound/pci/echoaudio/midi.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/sound/pci/echoaudio/midi.c b/sound/pci/echoaudio/midi.c
index e31f0f11e3a8..91f5bff66d3f 100644
--- a/sound/pci/echoaudio/midi.c
+++ b/sound/pci/echoaudio/midi.c
@@ -213,7 +213,7 @@ static void snd_echo_midi_output_write(unsigned long data)
sent = bytes = 0;
spin_lock_irqsave(&chip->lock, flags);
chip->midi_full = 0;
- if (chip->midi_out && !snd_rawmidi_transmit_empty(chip->midi_out)) {
+ if (!snd_rawmidi_transmit_empty(chip->midi_out)) {
bytes = snd_rawmidi_transmit_peek(chip->midi_out, buf,
MIDI_OUT_BUFFER_SIZE - 1);
DE_MID(("Try to send %d bytes...\n", bytes));
@@ -264,9 +264,11 @@ static void snd_echo_midi_output_trigger(struct snd_rawmidi_substream *substream
}
} else {
if (chip->tinuse) {
- del_timer(&chip->timer);
chip->tinuse = 0;
+ spin_unlock_irq(&chip->lock);
+ del_timer_sync(&chip->timer);
DE_MID(("Timer removed\n"));
+ return;
}
}
spin_unlock_irq(&chip->lock);