[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <200610312326.31526.jesper.juhl@gmail.com>
Date: Tue, 31 Oct 2006 23:26:31 +0100
From: Jesper Juhl <jesper.juhl@...il.com>
To: David Rientjes <rientjes@...washington.edu>
Cc: linux-kernel@...r.kernel.org, Giuliano Pochini <pochini@...ny.it>,
Takashi Iwai <tiwai@...e.de>,
Jesper Juhl <jesper.juhl@...il.com>
Subject: Re: [PATCH] Fix potential NULL pointer dereference in echoaudio midi.
On Tuesday 31 October 2006 23:13, David Rientjes wrote:
> On Tue, 31 Oct 2006, Jesper Juhl wrote:
>
> > In sound/pci/echoaudio/midi.c::snd_echo_midi_output_write(), there's a risk
> > of dereferencing a NULL 'chip->midi_out'.
> > This patch contains the obvious fix as also used a bit higher up in the
> > same function.
> >
>
> How about just adding an early test:
> if (!chip->midi_out)
> goto out;
>
> and adding a label for out before the chip->lock unlock? We still need to
> clear chip->midi_full so we still require the spinlock, but there's no
> reason we should be testing chip->midi_out multiple times since the
> remaining code path in its entirety depends on it.
>
Sure, that's an alternative solution. Probably a superiour one since, as
you say, we'll then only be testing 'chip->midi_out' once.
Here's a patch that makes that change instead.
I'll leave it up to the powers-that-be to pick the one they like best :)
Signed-off-by: Jesper Juhl <jesper.juhl@...il.com>
---
diff --git a/sound/pci/echoaudio/midi.c b/sound/pci/echoaudio/midi.c
index e31f0f1..0385b4e 100644
--- a/sound/pci/echoaudio/midi.c
+++ b/sound/pci/echoaudio/midi.c
@@ -213,7 +213,9 @@ static void snd_echo_midi_output_write(u
sent = bytes = 0;
spin_lock_irqsave(&chip->lock, flags);
chip->midi_full = 0;
- if (chip->midi_out && !snd_rawmidi_transmit_empty(chip->midi_out)) {
+ if (!chip->midi_out)
+ goto out;
+ if (!snd_rawmidi_transmit_empty(chip->midi_out)) {
bytes = snd_rawmidi_transmit_peek(chip->midi_out, buf,
MIDI_OUT_BUFFER_SIZE - 1);
DE_MID(("Try to send %d bytes...\n", bytes));
@@ -243,6 +245,7 @@ static void snd_echo_midi_output_write(u
mod_timer(&chip->timer, jiffies + (time * HZ + 999) / 1000);
DE_MID(("Timer armed(%d)\n", ((time * HZ + 999) / 1000)));
}
+ out:
spin_unlock_irqrestore(&chip->lock, flags);
}
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists