hrev48750 adds 1 changeset to branch 'master' old head: b8798becff738c4a9a973ad1ed6bb235752be72a new head: 3df82f281333e7a24c739adc5f1dc4cc7eb32ab6 overview: http://cgit.haiku-os.org/haiku/log/?qt=range&q=3df82f281333+%5Eb8798becff73 ---------------------------------------------------------------------------- 3df82f281333: usb_midi: fix crash when unplugging devices * When a midi device is unplugged, the driver deletes all the MIDI channels, and unblocks all pending accesses on those. The port structureis freed but the device kept a pointer to it. * When a transfer is cancelled, the driver would try to notify all callers waiting on the ports that the device is gone. But it's too late to access the port as it was already deleted (and the callers already unlocked). Reset the port pointer to NULL when deleting a port, so no further access to it is possible. Fixes #11533. Also remove an unused field in the usb midi device structure. [ Adrien Destugues <pulkomandy@xxxxxxxxx> ] ---------------------------------------------------------------------------- Revision: hrev48750 Commit: 3df82f281333e7a24c739adc5f1dc4cc7eb32ab6 URL: http://cgit.haiku-os.org/haiku/commit/?id=3df82f281333 Author: Adrien Destugues <pulkomandy@xxxxxxxxx> Date: Fri Jan 30 15:47:47 2015 UTC Ticket: https://dev.haiku-os.org/ticket/11533 ---------------------------------------------------------------------------- 2 files changed, 2 insertions(+), 4 deletions(-) src/add-ons/kernel/drivers/midi/usb_midi/usb_midi.cpp | 3 ++- src/add-ons/kernel/drivers/midi/usb_midi/usb_midi.h | 3 --- ---------------------------------------------------------------------------- diff --git a/src/add-ons/kernel/drivers/midi/usb_midi/usb_midi.cpp b/src/add-ons/kernel/drivers/midi/usb_midi/usb_midi.cpp index 771b522..c78a278 100644 --- a/src/add-ons/kernel/drivers/midi/usb_midi/usb_midi.cpp +++ b/src/add-ons/kernel/drivers/midi/usb_midi/usb_midi.cpp @@ -448,7 +448,7 @@ static status_t usb_midi_removed(void* cookie) { usbmidi_device_info* midiDevice = (usbmidi_device_info*)cookie; - + assert(cookie != NULL); DPRINTF_INFO((MY_ID "usb_midi_removed(%s)\n", midiDevice->name)); @@ -457,6 +457,7 @@ usb_midi_removed(void* cookie) usbmidi_port_info* port = midiDevice->ports[cable]; if (port == NULL) break; + midiDevice->ports[cable] = NULL; DPRINTF_DEBUG((MY_ID "removing port %d\n", cable)); if (port->open_fd != NULL) { remove_port_info(port); diff --git a/src/add-ons/kernel/drivers/midi/usb_midi/usb_midi.h b/src/add-ons/kernel/drivers/midi/usb_midi/usb_midi.h index 1784d3f..42dd5dd 100644 --- a/src/add-ons/kernel/drivers/midi/usb_midi/usb_midi.h +++ b/src/add-ons/kernel/drivers/midi/usb_midi/usb_midi.h @@ -73,9 +73,6 @@ struct driver_cookie; typedef struct usbmidi_device_info { - /* list structure */ /* should not be needed eventually */ - struct usbmidi_device_info* next; - /* Set of actual ports ("cables" -- one or more) */ struct usbmidi_port_info* ports[16];