ALSA: rawmidi - Add open check in rawmidi callbacks

The drivers (e.g. mtpav) may call rawmidi functions in irq handlers
even though the streams are not opened.  This results in Oops or panic.

This patch adds the rawmidi state check before actually operating the
rawmidi buffers.

Tested-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

1 files changed, 8 insertions, 0 deletions

diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index c4995c9f5730..39672f68ce5d 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -148,6 +148,8 @@ static int snd_rawmidi_runtime_free(struct snd_rawmidi_substream *substream)
 
 static inline void snd_rawmidi_output_trigger(struct snd_rawmidi_substream *substream,int up)
 {
+        if (!substream->opened)
+                return;
         if (up) {
                 tasklet_hi_schedule(&substream->runtime->tasklet);
         } else {
@@ -158,6 +160,8 @@ static inline void snd_rawmidi_output_trigger(struct snd_rawmidi_substream *subs
 
 static void snd_rawmidi_input_trigger(struct snd_rawmidi_substream *substream, int up)
 {
+        if (!substream->opened)
+                return;
         substream->ops->trigger(substream, up);
         if (!up && substream->runtime->event)
                 tasklet_kill(&substream->runtime->tasklet);
@@ -857,6 +861,8 @@ int snd_rawmidi_receive(struct snd_rawmidi_substream *substream,
         int result = 0, count1;
         struct snd_rawmidi_runtime *runtime = substream->runtime;
 
+        if (!substream->opened)
+                return -EBADFD;
         if (runtime->buffer == NULL) {
                 snd_printd("snd_rawmidi_receive: input is not active!!!\n");
                 return -EINVAL;
@@ -1126,6 +1132,8 @@ int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
 int snd_rawmidi_transmit(struct snd_rawmidi_substream *substream,
                          unsigned char *buffer, int count)
 {
+        if (!substream->opened)
+                return -EBADFD;
         count = snd_rawmidi_transmit_peek(substream, buffer, count);
         if (count < 0)
                 return count;