usb_midi: fix crash when unplugging devices
* When a midi device is unplugged, the driver deletes all the MIDI channels, and unblocks all pending accesses on those. The port structureis freed but the device kept a pointer to it. * When a transfer is cancelled, the driver would try to notify all callers waiting on the ports that the device is gone. But it's too late to access the port as it was already deleted (and the callers already unlocked). Reset the port pointer to NULL when deleting a port, so no further access to it is possible. Fixes #11533. Also remove an unused field in the usb midi device structure.
This commit is contained in:
@@ -448,7 +448,7 @@ static status_t
|
||||
usb_midi_removed(void* cookie)
|
||||
{
|
||||
usbmidi_device_info* midiDevice = (usbmidi_device_info*)cookie;
|
||||
|
||||
|
||||
assert(cookie != NULL);
|
||||
|
||||
DPRINTF_INFO((MY_ID "usb_midi_removed(%s)\n", midiDevice->name));
|
||||
@@ -457,6 +457,7 @@ usb_midi_removed(void* cookie)
|
||||
usbmidi_port_info* port = midiDevice->ports[cable];
|
||||
if (port == NULL)
|
||||
break;
|
||||
midiDevice->ports[cable] = NULL;
|
||||
DPRINTF_DEBUG((MY_ID "removing port %d\n", cable));
|
||||
if (port->open_fd != NULL) {
|
||||
remove_port_info(port);
|
||||
|
||||
@@ -73,9 +73,6 @@ struct driver_cookie;
|
||||
|
||||
typedef struct usbmidi_device_info
|
||||
{
|
||||
/* list structure */ /* should not be needed eventually */
|
||||
struct usbmidi_device_info* next;
|
||||
|
||||
/* Set of actual ports ("cables" -- one or more) */
|
||||
struct usbmidi_port_info* ports[16];
|
||||
|
||||
|
||||
Reference in New Issue
Block a user