lkml.org 
[lkml]   [2006]   [Oct]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
SubjectRe: [PATCH] Fix potential NULL pointer dereference in echoaudio midi.
Date
On Tuesday 31 October 2006 23:13, David Rientjes wrote:
> On Tue, 31 Oct 2006, Jesper Juhl wrote:
>
> > In sound/pci/echoaudio/midi.c::snd_echo_midi_output_write(), there's a risk
> > of dereferencing a NULL 'chip->midi_out'.
> > This patch contains the obvious fix as also used a bit higher up in the
> > same function.
> >
>
> How about just adding an early test:
> if (!chip->midi_out)
> goto out;
>
> and adding a label for out before the chip->lock unlock? We still need to
> clear chip->midi_full so we still require the spinlock, but there's no
> reason we should be testing chip->midi_out multiple times since the
> remaining code path in its entirety depends on it.
>

Sure, that's an alternative solution. Probably a superiour one since, as
you say, we'll then only be testing 'chip->midi_out' once.

Here's a patch that makes that change instead.
I'll leave it up to the powers-that-be to pick the one they like best :)


Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
---

diff --git a/sound/pci/echoaudio/midi.c b/sound/pci/echoaudio/midi.c
index e31f0f1..0385b4e 100644
--- a/sound/pci/echoaudio/midi.c
+++ b/sound/pci/echoaudio/midi.c
@@ -213,7 +213,9 @@ static void snd_echo_midi_output_write(u
sent = bytes = 0;
spin_lock_irqsave(&chip->lock, flags);
chip->midi_full = 0;
- if (chip->midi_out && !snd_rawmidi_transmit_empty(chip->midi_out)) {
+ if (!chip->midi_out)
+ goto out;
+ if (!snd_rawmidi_transmit_empty(chip->midi_out)) {
bytes = snd_rawmidi_transmit_peek(chip->midi_out, buf,
MIDI_OUT_BUFFER_SIZE - 1);
DE_MID(("Try to send %d bytes...\n", bytes));
@@ -243,6 +245,7 @@ static void snd_echo_midi_output_write(u
mod_timer(&chip->timer, jiffies + (time * HZ + 999) / 1000);
DE_MID(("Timer armed(%d)\n", ((time * HZ + 999) / 1000)));
}
+ out:
spin_unlock_irqrestore(&chip->lock, flags);
}


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2006-10-31 23:27    [W:0.111 / U:0.060 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site