[ALSA] sound: initialize rawmidi substream list (c13893d7) · Commits · 戴 / test

If snd_rawmidi_new() failed to allocate substreams for input (snd_rawmidi_alloc_substreams() failed to populate a &rmidi->streams[SNDRV_RAWMIDI_STREAM_INPUT]), it will try to free rawmidi instance by snd_rawmidi_free(). But it will cause oops because snd_rawmidi_free() tries to free both of substreams list but list for output (&rmidi->streams[SNDRV_RAWMIDI_STREAM_OUTPUT]) is not initialized yet. Signed-off-by:

Akinobu Mita <akinobu.mita@gmail.com> Signed-off-by:

Takashi Iwai <tiwai@suse.de> Signed-off-by:

Jaroslav Kysela <perex@suse.cz>

sound/core/rawmidi.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -1385,7 +1385,6 @@ static int snd_rawmidi_alloc_substreams(struct snd_rawmidi *rmidi,
		struct snd_rawmidi_substream *substream;
		int idx;

		INIT_LIST_HEAD(&stream->substreams);
		for (idx = 0; idx < count; idx++) {
		substream = kzalloc(sizeof(*substream), GFP_KERNEL);
		if (substream == NULL) {
		@@ -1440,6 +1439,9 @@ int snd_rawmidi_new(struct snd_card card, char id, int device,
		rmidi->device = device;
		mutex_init(&rmidi->open_mutex);
		init_waitqueue_head(&rmidi->open_wait);
		INIT_LIST_HEAD(&rmidi->streams[SNDRV_RAWMIDI_STREAM_INPUT].substreams);
		INIT_LIST_HEAD(&rmidi->streams[SNDRV_RAWMIDI_STREAM_OUTPUT].substreams);

		if (id != NULL)
		strlcpy(rmidi->id, id, sizeof(rmidi->id));
		if ((err = snd_rawmidi_alloc_substreams(rmidi,

Admin message