Messages in this thread | | | Date | Thu, 23 Nov 2006 12:06:48 +0100 | From | Takashi Iwai <> | Subject | Re: [PATCH] sound: fix PCM substream list |
| |
At Thu, 23 Nov 2006 03:51:45 +0900, Akinobu Mita wrote: > > If snd_pcm_new_stream() fails to initalize a substream (if > snd_pcm_substream_proc_init() returns error), snd_pcm_new_stream() > immediately return without unlinking that kfree()d substram. > > It causes oops when snd_pcm_free() iterates the list of substream to > free them by invalid reference. > > Cc: Takashi Iwai <tiwai@suse.de> > Cc: Jaroslav Kysela <perex@suse.cz> > Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Merged this one to ALSA tree, too. Thanks.
Takashi
> > --- > sound/core/pcm.c | 4 ++++ > 1 file changed, 4 insertions(+) > > Index: work-fault-inject/sound/core/pcm.c > =================================================================== > --- work-fault-inject.orig/sound/core/pcm.c > +++ work-fault-inject/sound/core/pcm.c > @@ -638,6 +638,10 @@ int snd_pcm_new_stream(struct snd_pcm *p > err = snd_pcm_substream_proc_init(substream); > if (err < 0) { > snd_printk(KERN_ERR "Error in snd_pcm_stream_proc_init\n"); > + if (prev == NULL) > + pstr->substream = NULL; > + else > + prev->next = NULL; > kfree(substream); > return err; > } > - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |