usb_midi: fix crash when unplugging devices

* When a midi device is unplugged, the driver deletes all the MIDI
channels, and unblocks all pending accesses on those. The port
structureis freed but the device kept a pointer to it.
* When a transfer is cancelled, the driver would try to notify all
callers waiting on the ports that the device is gone. But it's too late
to access the port as it was already deleted (and the callers already
unlocked).

Reset the port pointer to NULL when deleting a port, so no further
access to it is possible.

Fixes #11533.

Also remove an unused field in the usb midi device structure.
This commit is contained in:
Adrien Destugues
2015-01-30 16:52:20 +01:00
parent b8798becff
commit 3df82f2813
2 changed files with 2 additions and 4 deletions
@@ -448,7 +448,7 @@ static status_t
usb_midi_removed(void* cookie)
{
usbmidi_device_info* midiDevice = (usbmidi_device_info*)cookie;
assert(cookie != NULL);
DPRINTF_INFO((MY_ID "usb_midi_removed(%s)\n", midiDevice->name));
@@ -457,6 +457,7 @@ usb_midi_removed(void* cookie)
usbmidi_port_info* port = midiDevice->ports[cable];
if (port == NULL)
break;
midiDevice->ports[cable] = NULL;
DPRINTF_DEBUG((MY_ID "removing port %d\n", cable));
if (port->open_fd != NULL) {
remove_port_info(port);
@@ -73,9 +73,6 @@ struct driver_cookie;
typedef struct usbmidi_device_info
{
/* list structure */ /* should not be needed eventually */
struct usbmidi_device_info* next;
/* Set of actual ports ("cables" -- one or more) */
struct usbmidi_port_info* ports[16];