diff mbox series

ALSA: oxfw: fix NULL pointer dereference to unused stream structure

Message ID 20190826135415.27833-1-o-takashi@sakamocchi.jp (mailing list archive)
State New, archived
Headers show
Series ALSA: oxfw: fix NULL pointer dereference to unused stream structure | expand

Commit Message

Takashi Sakamoto Aug. 26, 2019, 1:54 p.m. UTC
ALSA oxfw driver supports Griffin FireWave. This device supports one
isochronous stream for PCM playback. Current driver executes code to
wait event for stream structure of opposite direction. This causes
NULL pointer dereference.

This commit fixes the bug.

Fixes: ac5d77864cfc ("ALSA: oxfw: support AMDTP domain")
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
---
 sound/firewire/oxfw/oxfw-stream.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

Comments

Takashi Iwai Aug. 26, 2019, 2:01 p.m. UTC | #1
On Mon, 26 Aug 2019 15:54:15 +0200,
Takashi Sakamoto wrote:
> 
> ALSA oxfw driver supports Griffin FireWave. This device supports one
> isochronous stream for PCM playback. Current driver executes code to
> wait event for stream structure of opposite direction. This causes
> NULL pointer dereference.
> 
> This commit fixes the bug.
> 
> Fixes: ac5d77864cfc ("ALSA: oxfw: support AMDTP domain")
> Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>

Thanks, applied.


Takashi
diff mbox series

Patch

diff --git a/sound/firewire/oxfw/oxfw-stream.c b/sound/firewire/oxfw/oxfw-stream.c
index 0318dc4dcc55..3c9a796b6526 100644
--- a/sound/firewire/oxfw/oxfw-stream.c
+++ b/sound/firewire/oxfw/oxfw-stream.c
@@ -350,13 +350,18 @@  int snd_oxfw_stream_start_duplex(struct snd_oxfw *oxfw)
 
 		// Wait first packet.
 		if (!amdtp_stream_wait_callback(&oxfw->rx_stream,
-						CALLBACK_TIMEOUT) ||
-		    !amdtp_stream_wait_callback(&oxfw->tx_stream,
 						CALLBACK_TIMEOUT)) {
 			err = -ETIMEDOUT;
 			goto error;
 		}
 
+		if (oxfw->has_output) {
+			if (!amdtp_stream_wait_callback(&oxfw->tx_stream,
+							CALLBACK_TIMEOUT)) {
+				err = -ETIMEDOUT;
+				goto error;
+			}
+		}
 	}
 
 	return 0;