2 files changed, 16 insertions, 6 deletions

diff --git a/sound/usb/6fire/midi.c b/sound/usb/6fire/midi.c
index 26722423330d..f3dd7266c391 100644
--- a/sound/usb/6fire/midi.c
+++ b/sound/usb/6fire/midi.c
@@ -19,6 +19,10 @@
 #include "chip.h"
 #include "comm.h"
 
+enum {
+        MIDI_BUFSIZE = 64
+};
+
 static void usb6fire_midi_out_handler(struct urb *urb)
 {
         struct midi_runtime *rt = urb->context;
@@ -156,6 +160,12 @@ int usb6fire_midi_init(struct sfire_chip *chip)
         if (!rt)
                 return -ENOMEM;
 
+        rt->out_buffer = kzalloc(MIDI_BUFSIZE, GFP_KERNEL);
+        if (!rt->out_buffer) {
+                kfree(rt);
+                return -ENOMEM;
+        }
+
         rt->chip = chip;
         rt->in_received = usb6fire_midi_in_received;
         rt->out_buffer[0] = 0x80; /* 'send midi' command */
@@ -169,6 +179,7 @@ int usb6fire_midi_init(struct sfire_chip *chip)
 
         ret = snd_rawmidi_new(chip->card, "6FireUSB", 0, 1, 1, &rt->instance);
         if (ret < 0) {
+                kfree(rt->out_buffer);
                 kfree(rt);
                 snd_printk(KERN_ERR PREFIX "unable to create midi.\n");
                 return ret;
@@ -197,6 +208,9 @@ void usb6fire_midi_abort(struct sfire_chip *chip)
 
 void usb6fire_midi_destroy(struct sfire_chip *chip)
 {
-        kfree(chip->midi);
+        struct midi_runtime *rt = chip->midi;
+
+        kfree(rt->out_buffer);
+        kfree(rt);
         chip->midi = NULL;
 }
diff --git a/sound/usb/6fire/midi.h b/sound/usb/6fire/midi.h
index c321006e5430..84851b9f5559 100644
--- a/sound/usb/6fire/midi.h
+++ b/sound/usb/6fire/midi.h
@@ -16,10 +16,6 @@
 
 #include "common.h"
 
-enum {
-        MIDI_BUFSIZE = 64
-};
-
 struct midi_runtime {
         struct sfire_chip *chip;
         struct snd_rawmidi *instance;
@@ -32,7 +28,7 @@ struct midi_runtime {
         struct snd_rawmidi_substream *out;
         struct urb out_urb;
         u8 out_serial; /* serial number of out packet */
-        u8 out_buffer[MIDI_BUFSIZE];
+        u8 *out_buffer;
         int buffer_offset;
 
         void (*in_received)(struct midi_runtime *rt, u8 *data, int length);