+++ /dev/null
-From 65766ee0bf7fe8b3be80e2e1c3ef54ad59b29476 Mon Sep 17 00:00:00 2001
-From: Takashi Iwai <tiwai@suse.de>
-Date: Fri, 9 Nov 2018 11:59:45 +0100
-Subject: ALSA: oss: Use kvzalloc() for local buffer allocations
-
-From: Takashi Iwai <tiwai@suse.de>
-
-commit 65766ee0bf7fe8b3be80e2e1c3ef54ad59b29476 upstream.
-
-PCM OSS layer may allocate a few temporary buffers, one for the core
-read/write and another for the conversions via plugins. Currently
-both are allocated via vmalloc(). But as the allocation size is
-equivalent with the PCM period size, the required size might be quite
-small, depending on the application.
-
-This patch replaces these vmalloc() calls with kvzalloc() for covering
-small period sizes better. Also, we use "z"-alloc variant here for
-addressing the possible uninitialized access reported by syzkaller.
-
-Reported-by: syzbot+1cb36954e127c98dd037@syzkaller.appspotmail.com
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- sound/core/oss/pcm_oss.c | 6 +++---
- sound/core/oss/pcm_plugin.c | 6 +++---
- 2 files changed, 6 insertions(+), 6 deletions(-)
-
---- a/sound/core/oss/pcm_oss.c
-+++ b/sound/core/oss/pcm_oss.c
-@@ -1073,8 +1073,8 @@ static int snd_pcm_oss_change_params_loc
- runtime->oss.channels = params_channels(params);
- runtime->oss.rate = params_rate(params);
-
-- vfree(runtime->oss.buffer);
-- runtime->oss.buffer = vmalloc(runtime->oss.period_bytes);
-+ kvfree(runtime->oss.buffer);
-+ runtime->oss.buffer = kvzalloc(runtime->oss.period_bytes, GFP_KERNEL);
- if (!runtime->oss.buffer) {
- err = -ENOMEM;
- goto failure;
-@@ -2380,7 +2380,7 @@ static void snd_pcm_oss_release_substrea
- {
- struct snd_pcm_runtime *runtime;
- runtime = substream->runtime;
-- vfree(runtime->oss.buffer);
-+ kvfree(runtime->oss.buffer);
- runtime->oss.buffer = NULL;
- #ifdef CONFIG_SND_PCM_OSS_PLUGINS
- snd_pcm_oss_plugin_clear(substream);
---- a/sound/core/oss/pcm_plugin.c
-+++ b/sound/core/oss/pcm_plugin.c
-@@ -66,8 +66,8 @@ static int snd_pcm_plugin_alloc(struct s
- return -ENXIO;
- size /= 8;
- if (plugin->buf_frames < frames) {
-- vfree(plugin->buf);
-- plugin->buf = vmalloc(size);
-+ kvfree(plugin->buf);
-+ plugin->buf = kvzalloc(size, GFP_KERNEL);
- plugin->buf_frames = frames;
- }
- if (!plugin->buf) {
-@@ -191,7 +191,7 @@ int snd_pcm_plugin_free(struct snd_pcm_p
- if (plugin->private_free)
- plugin->private_free(plugin);
- kfree(plugin->buf_channels);
-- vfree(plugin->buf);
-+ kvfree(plugin->buf);
- kfree(plugin);
- return 0;
- }