⬢ DragonFlyBSD Kernel Audit
DF-3880 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/sound/pcm/dsp.c
+++ b/sys/dev/sound/pcm/dsp.c
@@ -3046,6 +3046,13 @@ dsp_oss_syncstart(int sg_id)
 
 				needlocks = 1;
 				ret = 0; /* Assumes ret == EAGAIN... */
+				/* DF-3880: lksleep() dropped the syncgroup
+				 * lock while we slept, so sg and sm may
+				 * already be freed by a concurrent
+				 * SYNCSTART. Restart the scan from the
+				 * list head instead of resuming the walk
+				 * over freed members. */
+				break;
 			}
 		}
 	} while (needlocks && ret == 0);