From alsa-devel-owner@alsa.jcu.cz  Tue Feb  2 17:19:18 1999
Received: from smaux.kusm.kyoto-u.ac.jp (smaux.kusm.kyoto-u.ac.jp [130.54.53.12])
	by marvin.jcu.cz (8.9.1a/8.9.1) with SMTP id RAA23850
	for <alsa-devel@alsa.jcu.cz>; Tue, 2 Feb 1999 17:19:06 +0100
Received: (qmail 23596 invoked from network); 3 Feb 1999 01:18:55 +0900
Received: from ray.kusm.kyoto-u.ac.jp (130.54.53.49)
  by smaux.kusm.kyoto-u.ac.jp with SMTP; 3 Feb 1999 01:18:55 +0900
Received: (qmail 19456 invoked by uid 2161); 2 Feb 1999 16:18:54 -0000
Message-ID: <19990203011854.A19445@ray.kusm.kyoto-u.ac.jp>
Date: Wed, 3 Feb 1999 01:18:54 +0900
From: Yamahata Isaku <yamahata@kusm.kyoto-u.ac.jp>
To: alsa-devel@alsa.jcu.cz
Subject: [patch] seq_clientmgr.c reference count
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="0F1p//8PRICkK4MW"
Content-Transfer-Encoding: 7bit
Reply-To: alsa-devel@alsa.jcu.cz
Sender: alsa-devel-owner@alsa.jcu.cz
Precedence: list


--0F1p//8PRICkK4MW
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

On the function 
static void snd_seq_dispatch_single_event(snd_seq_event_cell_t * cell)
@ alsa-driver/kernel/seq/seq_clientmgr.c

snd_seq_dispatch_single_event increments the reference count of destination
client(snd_seq_client_use_ptr) and checks event filtering. If the destination
client does not accept the event, it returns.
But decrementing referencing count(snd_seq_client_unlock) is not done.
Attached patch fixes this bug.

---
Isaku Yamahata
yamahata@kusm.kyoto-u.ac.jp
CQG00274@nifty.ne.jp
http://www.kusm.kyoto-u.ac.jp/%7Eyamahata/
  
--0F1p//8PRICkK4MW
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="seq_clientmgr.diff"

--- seq_clientmgr.c	Tue Feb  2 05:46:02 1999
+++ seq_clientmgr.c.new	Wed Feb  3 01:12:25 1999
@@ -136,6 +136,8 @@
 	if (!test_bit(client->number, &q->clients_bitmap))
 		return 0;	/* fail */
 	unused = snd_seq_unused_cells(q->pool);
+	if (unused == 0)
+	        return 0;
 	if (unused < client->low[q->queue])
 		return 0;
 	if (snd_seq_total_cells(q->pool) - unused > client->high[q->queue])
@@ -631,20 +633,30 @@
 		return;
 
 	/* use filters here */
-	if (!dest_client->accept_input)
+	if (!dest_client->accept_input) {
+	        snd_seq_client_unlock(dest_client);
 		return;
+	}
 	if (source == SND_SEQ_ADDRESS_BROADCAST) {
-		if (!(dest_client->filter & SND_SEQ_FILTER_BROADCAST))
-			return;
+	         if (!(dest_client->filter & SND_SEQ_FILTER_BROADCAST)) {
+		         snd_seq_client_unlock(dest_client);
+			 return;
+		 }
 	} else if (source > 191) {	/* multicast */
-		if (!(dest_client->filter & SND_SEQ_FILTER_MULTICAST))
+	        if (!(dest_client->filter & SND_SEQ_FILTER_MULTICAST)) {
+		        snd_seq_client_unlock(dest_client);
 			return;
-		if (test_bit(source - 192, &dest_client->multicast_filter))
+		}
+		if (test_bit(source - 192, &dest_client->multicast_filter)) {
+		        snd_seq_client_unlock(dest_client);
 			return;
+		}
 	}
 	if (dest_client->filter & SND_SEQ_FILTER_USE_EVENT) {
-		if (!test_bit(cell->event.type, &dest_client->event_filter))
+	        if (!test_bit(cell->event.type, &dest_client->event_filter)) {
+		        snd_seq_client_unlock(dest_client);
 			return;
+		}
 	}
 
 	/* deliver event */

--0F1p//8PRICkK4MW--

