[ALSA] Fix potential NULL pointer dereference in echoaudio midi

Fix races between the timer handler and the close function.

Signed-off-by: Giuliano Pochini <pochini@shiny.it>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>

diff --git a/sound/pci/echoaudio/midi.c b/sound/pci/echoaudio/midi.c
index e31f0f11e3a875c095a07426bf3b1521722d72e0..91f5bff66d3f923fa870184bfc3705be62b1f7a9 100644 (file)
--- a/sound/pci/echoaudio/midi.c
+++ b/sound/pci/echoaudio/midi.c
@@ -213,7 +213,7 @@ static void snd_echo_midi_output_write(unsigned long data)
        sent = bytes = 0;
        spin_lock_irqsave(&chip->lock, flags);
        chip->midi_full = 0;
-       if (chip->midi_out && !snd_rawmidi_transmit_empty(chip->midi_out)) {
+       if (!snd_rawmidi_transmit_empty(chip->midi_out)) {
                bytes = snd_rawmidi_transmit_peek(chip->midi_out, buf,
                                                  MIDI_OUT_BUFFER_SIZE - 1);
                DE_MID(("Try to send %d bytes...\n", bytes));
@@ -264,9 +264,11 @@ static void snd_echo_midi_output_trigger(struct snd_rawmidi_substream *substream
                }
        } else {
                if (chip->tinuse) {
-                       del_timer(&chip->timer);
                        chip->tinuse = 0;
+                       spin_unlock_irq(&chip->lock);
+                       del_timer_sync(&chip->timer);
                        DE_MID(("Timer removed\n"));
+                       return;
                }
        }
        spin_unlock_irq(&chip->lock);