The drivers (e.g. mtpav) may call rawmidi functions in irq handlers
even though the streams are not opened. This results in Oops or panic.
This patch adds the rawmidi state check before actually operating the
rawmidi buffers.
Tested-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
static inline void snd_rawmidi_output_trigger(struct snd_rawmidi_substream *substream,int up)
{
static inline void snd_rawmidi_output_trigger(struct snd_rawmidi_substream *substream,int up)
{
+ if (!substream->opened)
+ return;
if (up) {
tasklet_hi_schedule(&substream->runtime->tasklet);
} else {
if (up) {
tasklet_hi_schedule(&substream->runtime->tasklet);
} else {
static void snd_rawmidi_input_trigger(struct snd_rawmidi_substream *substream, int up)
{
static void snd_rawmidi_input_trigger(struct snd_rawmidi_substream *substream, int up)
{
+ if (!substream->opened)
+ return;
substream->ops->trigger(substream, up);
if (!up && substream->runtime->event)
tasklet_kill(&substream->runtime->tasklet);
substream->ops->trigger(substream, up);
if (!up && substream->runtime->event)
tasklet_kill(&substream->runtime->tasklet);
int result = 0, count1;
struct snd_rawmidi_runtime *runtime = substream->runtime;
int result = 0, count1;
struct snd_rawmidi_runtime *runtime = substream->runtime;
+ if (!substream->opened)
+ return -EBADFD;
if (runtime->buffer == NULL) {
snd_printd("snd_rawmidi_receive: input is not active!!!\n");
return -EINVAL;
if (runtime->buffer == NULL) {
snd_printd("snd_rawmidi_receive: input is not active!!!\n");
return -EINVAL;
int snd_rawmidi_transmit(struct snd_rawmidi_substream *substream,
unsigned char *buffer, int count)
{
int snd_rawmidi_transmit(struct snd_rawmidi_substream *substream,
unsigned char *buffer, int count)
{
+ if (!substream->opened)
+ return -EBADFD;
count = snd_rawmidi_transmit_peek(substream, buffer, count);
if (count < 0)
return count;
count = snd_rawmidi_transmit_peek(substream, buffer, count);
if (count < 0)
return count;