Skip to content

Commit 20c0c49

Browse files
committed
ALSA: rawmidi: Fix kvfree() call in spinlock
At the conversion of locking with guard(), I overlooked that kvfree() must not be called inside the spinlock unlike kfree(), and this was caught by syzkaller now. This patch reverts the conversion partially for restoring the kvfree() call outside the spinlock. It's not trivial to use guard() in this context, unfortunately. Fixes: 84bb065 ("ALSA: rawmidi: Use guard() for locking") Reported-by: [email protected] Reported-by: Eric Dumazet <[email protected]> Closes: https://lore.kernel.org/[email protected] Cc: <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Takashi Iwai <[email protected]>
1 parent 5ebe792 commit 20c0c49

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

sound/core/rawmidi.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -724,15 +724,17 @@ static int resize_runtime_buffer(struct snd_rawmidi_substream *substream,
724724
newbuf = kvzalloc(params->buffer_size, GFP_KERNEL);
725725
if (!newbuf)
726726
return -ENOMEM;
727-
guard(spinlock_irq)(&substream->lock);
727+
spin_lock_irq(&substream->lock);
728728
if (runtime->buffer_ref) {
729+
spin_unlock_irq(&substream->lock);
729730
kvfree(newbuf);
730731
return -EBUSY;
731732
}
732733
oldbuf = runtime->buffer;
733734
runtime->buffer = newbuf;
734735
runtime->buffer_size = params->buffer_size;
735736
__reset_runtime_ptrs(runtime, is_input);
737+
spin_unlock_irq(&substream->lock);
736738
kvfree(oldbuf);
737739
}
738740
runtime->avail_min = params->avail_min;

0 commit comments

Comments
 (0)