sound:core:oss: what determines the value of plugin->extra_data in rate_src_frames()?

[Xingyu Li]

Hi all,

I encountered a problem about ALSA subsystem when I try to reproduce a bug
https://syzkaller.appspot.com/bug?id=54576f48248190caa29334a754275ce5e1d8be95
.
I run the PoC https://syzkaller.appspot.com/text?tag=ReproC&x=1275090ee00000,
it is supposed to crash the  kernel. But it sometimes does not.
Then I found the point is rate_src_frames() in sound/core/oss/rate.c. When
I can not reproduce the bug,data->old_src_frames variable
in rate_src_frames() and the passed arguments
frames are both 11. When it can reproduce, the value
of data->old_src_frames is 85. The variable data is one member extra_data
in plugin variable. But I can not find where it write to
plugin->extra_data. So I want to what determines the value
of plugin->extra_data? Why is the value of it different at different time?

Thanks