ALSA: seq: Fix missing NULL check at remove_events ioctl

snd_seq_ioctl_remove_events() calls snd_seq_fifo_clear()
unconditionally even if there is no FIFO assigned, and this leads to
an Oops due to NULL dereference.  The fix is just to add a proper NULL
check.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
static int snd_seq_ioctl_get_queue_timer(struct snd_seq_client *client,
					 void __user *arg)
{
	struct snd_seq_queue_timer timer;
	struct snd_seq_queue *queue;
	struct snd_seq_timer *tmr;

	if (copy_from_user(&timer, arg, sizeof(timer)))
		return -EFAULT;

	queue = queueptr(timer.queue);
	if (queue == NULL)
		return -EINVAL;

	if (mutex_lock_interruptible(&queue->timer_mutex)) {
		queuefree(queue);
		return -ERESTARTSYS;
	}
	tmr = queue->timer;
	memset(&timer, 0, sizeof(timer));
	timer.queue = queue->queue;

	timer.type = tmr->type;
	if (tmr->type == SNDRV_SEQ_TIMER_ALSA) {
		timer.u.alsa.id = tmr->alsa_id;
		timer.u.alsa.resolution = tmr->preferred_resolution;
	}
	mutex_unlock(&queue->timer_mutex);
	queuefree(queue);
	
	if (copy_to_user(arg, &timer, sizeof(timer)))
		return -EFAULT;
	return 0;
}

static int snd_seq_ioctl_get_queue_timer(struct snd_seq_client *client,
					 void __user *arg)
{
	struct snd_seq_queue_timer timer;
	struct snd_seq_queue *queue;
	struct snd_seq_timer *tmr;

	if (copy_from_user(&timer, arg, sizeof(timer)))
		return -EFAULT;

	queue = queueptr(timer.queue);
	if (queue == NULL)
		return -EINVAL;

	if (mutex_lock_interruptible(&queue->timer_mutex)) {
		queuefree(queue);
		return -ERESTARTSYS;
	}
	tmr = queue->timer;
	memset(&timer, 0, sizeof(timer));
	timer.queue = queue->queue;

	timer.type = tmr->type;
	if (tmr->type == SNDRV_SEQ_TIMER_ALSA) {
		timer.u.alsa.id = tmr->alsa_id;
		timer.u.alsa.resolution = tmr->preferred_resolution;
	}
	mutex_unlock(&queue->timer_mutex);
	queuefree(queue);
	
	if (copy_to_user(arg, &timer, sizeof(timer)))
		return -EFAULT;
	return 0;
}
