[prev in list] [next in list] [prev in thread] [next in thread] 

List:       linux-sound
Subject:    PATCH: fix for soundblaster module oops at rmmod time (fwd)
From:       Matthias Hanisch <matze () camline ! com>
Date:       2001-09-20 15:10:40
[Download RAW message or body]

Hi!

Hopefully this is the right forum to report soundblaster-related bugs.
Please forward answers/questions also to me directly, I'm not subscribed
on the list.

Soundblaster module in version 2.4.10-pre9 and many (pre-)patches before
oopsed in sb_dsp_unload at the module deletion phase.

Loading the module reports

Sep 17 23:08:05 pingu kernel: <Sound Blaster (8 BIT/MONO ONLY) (2.01)> at
0x220 irq 5 dma 1>

so sb_mixer_init() is not called, because devc->major == 2.

Problem is that at "module deletion time", the call to sb_mixer_unload()
is unconditional and a

        kfree(mixer_devs[devc->my_mixerdev]);

is not very healthy if devc->my_mixerdev == -1 (the initial value).

This kfree() call without checking the array index got introduced in
2.4.8, sound_unload_mixerdev() which is called after kfree() contains a
check for devc->my_mixerdev != -1.

The attached patch cures this, it just introduces this check. It should
apply to any recent kernel.

Regards,
        Matze

-- 
Matthias Hanisch    mailto:matze@camline.com    phone: +49 8137 935-219


["1" (TEXT/PLAIN)]

diff -ru linux/drivers/sound/sb_mixer.c linux-matze/drivers/sound/sb_mixer.c
--- linux/drivers/sound/sb_mixer.c	Mon Sep 17 23:36:38 2001
+++ linux-matze/drivers/sound/sb_mixer.c	Tue Sep 18 00:39:47 2001
@@ -748,6 +748,9 @@
 
 void sb_mixer_unload(sb_devc *devc)
 {
+	if (devc->my_mixerdev == -1)
+		return;
+
 	kfree(mixer_devs[devc->my_mixerdev]);
 	sound_unload_mixerdev(devc->my_mixerdev);
 	sbmixnum--;

-
To unsubscribe from this list: send the line "unsubscribe linux-sound" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[prev in list] [next in list] [prev in thread] [next in thread]