Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5d2560a4 authored by Takashi Sakamoto's avatar Takashi Sakamoto Committed by Takashi Iwai
Browse files

ALSA: firewire-tascam: fix NULL pointer dereference when model identification fails 



When unsupported models are connected, snd-firewire-tascam module causes
NULL pointer dereference in fw_core_remove_address_handler() (due to
list_del_rcu()).

This commit prevents this bug.

Signed-off-by: default avatarTakashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 360a8245

sound/firewire/tascam/tascam-transaction.c

+6 −0
Original line number Diff line number Diff line
@@ -230,6 +230,7 @@ int snd_tscm_transaction_register(struct snd_tscm *tscm) 
	return err;

error:

	fw_core_remove_address_handler(&tscm->async_handler);

	tscm->async_handler.callback_data = NULL;

	return err;

}
@@ -276,6 +277,9 @@ void snd_tscm_transaction_unregister(struct snd_tscm *tscm) 
	__be32 reg;

	unsigned int i;



	if (tscm->async_handler.callback_data == NULL)

		return;



	/* Turn off FireWire LED. */

	reg = cpu_to_be32(0x0000008e);

	snd_fw_transaction(tscm->unit, TCODE_WRITE_QUADLET_REQUEST,
@@ -297,6 +301,8 @@ void snd_tscm_transaction_unregister(struct snd_tscm *tscm) 
			   &reg, sizeof(reg), 0);



	fw_core_remove_address_handler(&tscm->async_handler);

	tscm->async_handler.callback_data = NULL;



	for (i = 0; i < TSCM_MIDI_OUT_PORT_MAX; i++)

		snd_fw_async_midi_port_destroy(&tscm->out_ports[i]);

}