Re: [PATCH] Fix potential NULL pointer dereference in echoaudio midi.

On Tuesday 31 October 2006 23:13, David Rientjes wrote:
On Tue, 31 Oct 2006, Jesper Juhl wrote:

In sound/pci/echoaudio/midi.c::snd_echo_midi_output_write(), there's a risk
of dereferencing a NULL 'chip->midi_out'.
This patch contains the obvious fix as also used a bit higher up in the
same function.


How about just adding an early test:
if (!chip->midi_out)
goto out;

and adding a label for out before the chip->lock unlock? We still need to
clear chip->midi_full so we still require the spinlock, but there's no
reason we should be testing chip->midi_out multiple times since the
remaining code path in its entirety depends on it.


Sure, that's an alternative solution. Probably a superiour one since, as
you say, we'll then only be testing 'chip->midi_out' once.

Here's a patch that makes that change instead.
I'll leave it up to the powers-that-be to pick the one they like best :)


Signed-off-by: Jesper Juhl <jesper.juhl@xxxxxxxxx>
---

diff --git a/sound/pci/echoaudio/midi.c b/sound/pci/echoaudio/midi.c
index e31f0f1..0385b4e 100644
--- a/sound/pci/echoaudio/midi.c
+++ b/sound/pci/echoaudio/midi.c
@@ -213,7 +213,9 @@ static void snd_echo_midi_output_write(u
sent = bytes = 0;
spin_lock_irqsave(&chip->lock, flags);
chip->midi_full = 0;
- if (chip->midi_out && !snd_rawmidi_transmit_empty(chip->midi_out)) {
+ if (!chip->midi_out)
+ goto out;
+ if (!snd_rawmidi_transmit_empty(chip->midi_out)) {
bytes = snd_rawmidi_transmit_peek(chip->midi_out, buf,
MIDI_OUT_BUFFER_SIZE - 1);
DE_MID(("Try to send %d bytes...\n", bytes));
@@ -243,6 +245,7 @@ static void snd_echo_midi_output_write(u
mod_timer(&chip->timer, jiffies + (time * HZ + 999) / 1000);
DE_MID(("Timer armed(%d)\n", ((time * HZ + 999) / 1000)));
}
+ out:
spin_unlock_irqrestore(&chip->lock, flags);
}



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

Relevant Pages