diff mbox series

ALSA: dice: fix null pointer dereference when node is disconnected

Message ID 20210312093407.23437-1-o-takashi@sakamocchi.jp (mailing list archive)
State Accepted
Commit dd7b836d6bc935df95c826f69ff4d051f5561604
Headers show
Series ALSA: dice: fix null pointer dereference when node is disconnected | expand

Commit Message

Takashi Sakamoto March 12, 2021, 9:34 a.m. UTC
When node is removed from IEEE 1394 bus, any transaction fails to the node.
In the case, ALSA dice driver doesn't stop isochronous contexts even if
they are running. As a result, null pointer dereference occurs in callback
from the running context.

This commit fixes the bug to release isochronous contexts always.

Cc: <stable@vger.kernel.org> # v5.4 or later
Fixes: e9f21129b8d8 ("ALSA: dice: support AMDTP domain")
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
---
 sound/firewire/dice/dice-stream.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

Comments

Takashi Iwai March 12, 2021, 1:13 p.m. UTC | #1
On Fri, 12 Mar 2021 10:34:07 +0100,
Takashi Sakamoto wrote:
> 
> When node is removed from IEEE 1394 bus, any transaction fails to the node.
> In the case, ALSA dice driver doesn't stop isochronous contexts even if
> they are running. As a result, null pointer dereference occurs in callback
> from the running context.
> 
> This commit fixes the bug to release isochronous contexts always.
> 
> Cc: <stable@vger.kernel.org> # v5.4 or later
> Fixes: e9f21129b8d8 ("ALSA: dice: support AMDTP domain")
> Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>

Applied, thanks.


Takashi
diff mbox series

Patch

diff --git a/sound/firewire/dice/dice-stream.c b/sound/firewire/dice/dice-stream.c
index 8e0c0380b4c4..1a14c083e8ce 100644
--- a/sound/firewire/dice/dice-stream.c
+++ b/sound/firewire/dice/dice-stream.c
@@ -493,11 +493,10 @@  void snd_dice_stream_stop_duplex(struct snd_dice *dice)
 	struct reg_params tx_params, rx_params;
 
 	if (dice->substreams_counter == 0) {
-		if (get_register_params(dice, &tx_params, &rx_params) >= 0) {
-			amdtp_domain_stop(&dice->domain);
+		if (get_register_params(dice, &tx_params, &rx_params) >= 0)
 			finish_session(dice, &tx_params, &rx_params);
-		}
 
+		amdtp_domain_stop(&dice->domain);
 		release_resources(dice);
 	}
 }