Re: [PATCH] Fix potential NULL pointer dereference in echoaudio midi.

[Jesper Juhl <jesper.juhl@gmail.com>]

On Tuesday 31 October 2006 23:13, David Rientjes wrote:
> On Tue, 31 Oct 2006, Jesper Juhl wrote:
> 
> > In sound/pci/echoaudio/midi.c::snd_echo_midi_output_write(), there's a risk
> > of dereferencing a NULL 'chip->midi_out'.
> > This patch contains the obvious fix as also used a bit higher up in the 
> > same function.
> > 
> 
> How about just adding an early test:
> 	if (!chip->midi_out)
> 		goto out;
> 
> and adding a label for out before the chip->lock unlock?  We still need to 
> clear chip->midi_full so we still require the spinlock, but there's no 
> reason we should be testing chip->midi_out multiple times since the 
> remaining code path in its entirety depends on it.
> 

Sure, that's an alternative solution. Probably a superiour one since, as 
you say, we'll then only be testing 'chip->midi_out' once.

Here's a patch that makes that change instead.
I'll leave it up to the powers-that-be to pick the one they like best :)


Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
---

diff --git a/sound/pci/echoaudio/midi.c b/sound/pci/echoaudio/midi.c
index e31f0f1..0385b4e 100644
--- a/sound/pci/echoaudio/midi.c
+++ b/sound/pci/echoaudio/midi.c
@@ -213,7 +213,9 @@ static void snd_echo_midi_output_write(u
 	sent = bytes = 0;
 	spin_lock_irqsave(&chip->lock, flags);
 	chip->midi_full = 0;
-	if (chip->midi_out && !snd_rawmidi_transmit_empty(chip->midi_out)) {
+	if (!chip->midi_out)
+		goto out;
+	if (!snd_rawmidi_transmit_empty(chip->midi_out)) {
 		bytes = snd_rawmidi_transmit_peek(chip->midi_out, buf,
 						  MIDI_OUT_BUFFER_SIZE - 1);
 		DE_MID(("Try to send %d bytes...\n", bytes));
@@ -243,6 +245,7 @@ static void snd_echo_midi_output_write(u
 		mod_timer(&chip->timer, jiffies + (time * HZ + 999) / 1000);
 		DE_MID(("Timer armed(%d)\n", ((time * HZ + 999) / 1000)));
 	}
+ out:
 	spin_unlock_irqrestore(&chip->lock, flags);
 }