Commit 0125de38 authored by Takashi Iwai's avatar Takashi Iwai
Browse files

ALSA: usb-audio: Cancel pending work at closing a MIDI substream 



At closing a USB MIDI output substream, there might be still a pending
work, which would eventually access the rawmidi runtime object that is
being released.  For fixing the race, make sure to cancel the pending
work at closing.

Reported-by: default avatar <syzbot+6912c9592caca7ca0e7d@syzkaller.appspotmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/000000000000e7e75005dfd07cf6@google.com
Link: https://lore.kernel.org/r/20220525131203.11299-1-tiwai@suse.de


Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 4c691a28

sound/usb/midi.c

+3 −0
Original line number Diff line number Diff line
@@ -1145,6 +1145,9 @@ static int snd_usbmidi_output_open(struct snd_rawmidi_substream *substream) 


static int snd_usbmidi_output_close(struct snd_rawmidi_substream *substream)

{

	struct usbmidi_out_port *port = substream->runtime->private_data;



	cancel_work_sync(&port->ep->work);

	return substream_open(substream, 0, 0);

}