From 3df82f281333e7a24c739adc5f1dc4cc7eb32ab6 Mon Sep 17 00:00:00 2001 From: Adrien Destugues Date: Fri, 30 Jan 2015 16:47:47 +0100 Subject: [PATCH] usb_midi: fix crash when unplugging devices * When a midi device is unplugged, the driver deletes all the MIDI channels, and unblocks all pending accesses on those. The port structureis freed but the device kept a pointer to it. * When a transfer is cancelled, the driver would try to notify all callers waiting on the ports that the device is gone. But it's too late to access the port as it was already deleted (and the callers already unlocked). Reset the port pointer to NULL when deleting a port, so no further access to it is possible. Fixes #11533. Also remove an unused field in the usb midi device structure. --- src/add-ons/kernel/drivers/midi/usb_midi/usb_midi.cpp | 3 ++- src/add-ons/kernel/drivers/midi/usb_midi/usb_midi.h | 3 --- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/src/add-ons/kernel/drivers/midi/usb_midi/usb_midi.cpp b/src/add-ons/kernel/drivers/midi/usb_midi/usb_midi.cpp index 771b5229c0..c78a278844 100644 --- a/src/add-ons/kernel/drivers/midi/usb_midi/usb_midi.cpp +++ b/src/add-ons/kernel/drivers/midi/usb_midi/usb_midi.cpp @@ -448,7 +448,7 @@ static status_t usb_midi_removed(void* cookie) { usbmidi_device_info* midiDevice = (usbmidi_device_info*)cookie; - + assert(cookie != NULL); DPRINTF_INFO((MY_ID "usb_midi_removed(%s)\n", midiDevice->name)); @@ -457,6 +457,7 @@ usb_midi_removed(void* cookie) usbmidi_port_info* port = midiDevice->ports[cable]; if (port == NULL) break; + midiDevice->ports[cable] = NULL; DPRINTF_DEBUG((MY_ID "removing port %d\n", cable)); if (port->open_fd != NULL) { remove_port_info(port); diff --git a/src/add-ons/kernel/drivers/midi/usb_midi/usb_midi.h b/src/add-ons/kernel/drivers/midi/usb_midi/usb_midi.h index 1784d3f3e9..42dd5dd066 100644 --- a/src/add-ons/kernel/drivers/midi/usb_midi/usb_midi.h +++ b/src/add-ons/kernel/drivers/midi/usb_midi/usb_midi.h @@ -73,9 +73,6 @@ struct driver_cookie; typedef struct usbmidi_device_info { - /* list structure */ /* should not be needed eventually */ - struct usbmidi_device_info* next; - /* Set of actual ports ("cables" -- one or more) */ struct usbmidi_port_info* ports[16];