ALSA: timer: fix NULL pointer dereference in read()/ioctl() race