It is unsafe to free buffers in line6_pcm_stop(), which is not allowed
to sleep, since urbs cannot be killed completely there and only
unlinked. This means I/O may still be in progress and the URB
completion function still gets invoked. This may result in memory
corruption when buffer_in is freed but I/O is still pending.
Additionally, line6_pcm_start() is not supposed to sleep so it should
not use kmalloc(GFP_KERNEL).
These issues can be resolved by performing buffer allocation/freeing in
the .hw_params/.hw_free callbacks instead. The ALSA documentation also
recommends doing buffer allocation/freeing in these callbacks.
Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
140e28b83c