diff options
| author | Pavel Roskin <proski@org.rmk.(none)> | 2003-05-28 17:41:22 +0100 |
|---|---|---|
| committer | Russell King <rmk@flint.arm.linux.org.uk> | 2003-05-28 17:41:22 +0100 |
| commit | a22fcf63f4fe979546c646661ec0d39b005b5100 (patch) | |
| tree | bc0cbad7192e10bcd50be3a44a988283b38323fa | |
| parent | 201313f556a19561199aa6e7a73c736ec1a03520 (diff) | |
[PATCH] Fix crash when unloading yenta_socket in Linux 2.5.69
socket->base is unmapped in yenta_close(), which is called by
cardbus_remove(). The value of socket->base is not changed to
NULL, so it becomes invalid.
Then cardbus_remove() calls class_device_unregister(), which calls
pcmcia_unregister_socket(), which it turn tries to access memory
space of the socket.
| -rw-r--r-- | drivers/pcmcia/pci_socket.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/pcmcia/pci_socket.c b/drivers/pcmcia/pci_socket.c index c48b05ba8828..493e8fd0756e 100644 --- a/drivers/pcmcia/pci_socket.c +++ b/drivers/pcmcia/pci_socket.c @@ -196,9 +196,9 @@ static void __devexit cardbus_remove (struct pci_dev *dev) pci_socket_t *socket = pci_get_drvdata(dev); /* note: we are already unregistered from the cs core */ + class_device_unregister(&socket->cls_d.class_dev); if (socket->op && socket->op->close) socket->op->close(socket); - class_device_unregister(&socket->cls_d.class_dev); pci_set_drvdata(dev, NULL); } |