On Sunday 13 January 2008 22:20:52 Eric Paris wrote: > inside b43_rfkill_exit() we call rfkill_unregister() which puts the last > reference and frees the rfkill struct. Then just 3 lines later the code > explicitly calls rfkill_free() on the struct we already freed. This > showed up as slub corruption (what should have been 6b was showing up as > 6a) since the rfkill_free had dec'ed the are that should have been the > use counter. > > stop using the already freed rfkill struct. > > ============================================================================= > BUG kmalloc-1024 (Not tainted): Poison overwritten > ----------------------------------------------------------------------------- > > INFO: 0xf40b89e8-0xf40b89e8. First byte 0x6a instead of 0x6b > INFO: Allocated in rfkill_allocate+0x1b/0x8b [rfkill] age=231032011 cpu=0 pid=2403 > INFO: Freed in rfkill_release+0xd/0x19 [rfkill] age=366 cpu=0 pid=2403 > INFO: Slab 0xc1b62840 used=6 fp=0xf40b8860 flags=0x400040c3 > INFO: Object 0xf40b8860 @offset=2144 fp=0x00000000 > > Signed-off-by: Eric Paris <eparis@xxxxxxxxxx> > > --- > > drivers/net/wireless/b43/rfkill.c | 1 - > 1 file changed, 1 deletion(-) > > diff --git a/drivers/net/wireless/b43/rfkill.c b/drivers/net/wireless/b43/rfkill.c > index 98cf70c..a19be53 100644 > --- a/drivers/net/wireless/b43/rfkill.c > +++ b/drivers/net/wireless/b43/rfkill.c > @@ -195,6 +195,5 @@ void b43_rfkill_exit(struct b43_wldev *dev) > rfkill_unregister(rfk->rfkill); > input_free_polled_device(rfk->poll_dev); > rfk->poll_dev = NULL; > - rfkill_free(rfk->rfkill); > rfk->rfkill = NULL; > } > > > > NACK. Better patch available from Stefano. -- Greetings Michael. - To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
