diff options
| author | Christos Margiolis <christos@FreeBSD.org> | 2026-06-12 06:19:07 +0000 |
|---|---|---|
| committer | Christos Margiolis <christos@FreeBSD.org> | 2026-06-20 19:04:50 +0000 |
| commit | 47efa8128268c35ac8f0a552d7a7ce43cd1c5925 (patch) | |
| tree | 965f10ac063df00ee044b02c3c30af13f343de79 | |
| parent | 0c8147ae3bc1c7db95098fcc92fc2e86111f59d3 (diff) | |
sound: Handle CHN_F_MMAP_INVALID after cdev_pager_allocate()
We drop the channel lock to execute cdev_pager_allocate(). By the time
we pick up the lock again, CHN_F_MMAP_INVALID might be set, so make sure
we fail and free the vm handle.
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Reviewed by: markj, kib
Pull-Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/30
| -rw-r--r-- | sys/dev/sound/pcm/dsp.c | 20 |
1 files changed, 17 insertions, 3 deletions
diff --git a/sys/dev/sound/pcm/dsp.c b/sys/dev/sound/pcm/dsp.c index 52c30f847f01..8bb07d87fac9 100644 --- a/sys/dev/sound/pcm/dsp.c +++ b/sys/dev/sound/pcm/dsp.c @@ -1957,6 +1957,7 @@ dsp_mmap_single(struct cdev *cdev, vm_ooffset_t *offset, struct snddev_info *d; struct pcm_channel *c; int err; + bool dealloc; if (*offset >= *offset + size) return (EINVAL); @@ -2008,12 +2009,25 @@ dsp_mmap_single(struct cdev *cdev, vm_ooffset_t *offset, *object = cdev_pager_allocate(handle, OBJT_DEVICE, &dsp_dev_pager_ops, size, nprot, *offset, curthread->td_ucred); PCM_GIANT_LEAVE(d); - if (*object == NULL) { + if (*object != NULL) { + err = 0; + dealloc = false; + CHN_LOCK(c); + if (c->flags & CHN_F_MMAP_INVALID) { + c->flags &= ~CHN_F_MMAP; + err = EINVAL; + dealloc = true; + } + CHN_UNLOCK(c); + /* We use a helper bool to keep the channel locking simpler. */ + if (dealloc) + vm_object_deallocate(*object); + } else { free(handle, M_DEVBUF); - return (EINVAL); + err = ENOMEM; } - return (0); + return (err); } static const char *dsp_aliases[] = { |