lkml.org 
[lkml]   [2004]   [Feb]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: 2.6.3-bk5 isdn oops
Dave Jones <davej@redhat.com> :
[...]
> ISDN subsystem Rev: 1.1.2.3/1.1.2.3/1.1.2.2/1.1.2.3/1.1.2.2/1.1.2.2 loaded
> ICN-ISDN-driver Rev 1.65.6.8 mem=0x000d0000
> icn: (line0) ICN-2B, port 0x320 added
> Debug: sleeping function called from invalid context at include/linux/rwsem.h:43in_atomic():0, irqs_disabled():1
> Call Trace:
> [<c0123214>] __might_sleep+0x80/0x8a
> [<c011df07>] do_page_fault+0x71/0x46c
> [<c7b0ffd7>] isdn_status_callback+0x8e0/0x968 [isdn]
> [<c0121447>] schedule+0x5a6/0x631
> [<c01213c8>] schedule+0x527/0x631
> [<c011de96>] do_page_fault+0x0/0x46c
> [<c010c165>] error_code+0x2d/0x38
> [<c79aba66>] icn_exit+0xb4/0x155 [icn]

drivers/isdn/i4l/isdn_common.c
745 isdn_status_callback(isdn_ctrl *c)
[...]
767 case ISDN_STAT_UNLOAD:
768 rc = fsm_event(&drv->fi, EV_STAT_UNLOAD, c);
[...]
886 put_drv(drv);
^^^ -> let's name this one "catherine"


drivers/isdn/i4l/isdn_common.c
630 drv_stat_unload(struct fsm_inst *fi, int pr, void *arg)
[...]
638 put_drv(drv);
^^^ -> let's name this one "therese"

One has:
therese = catherine->fi->userdata

Given:

drivers/isdn/i4l/isdn_common.c
896 register_isdn(isdn_if *iif)
[...]
915 drv->fi.userdata = drv;

One checks that:
catherine = catherine->fi->userdata

So catherine = therese and there is a double put_drv() on the same pointer.
put_drv(drv)
-> drv_destroy(drv)
-> kfree(drv->slots);

Oops.

--
Ueimor
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:01    [W:0.044 / U:1.264 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site