Commit 568c3355 authored by Pavel Roskin's avatar Pavel Roskin Committed by Russell King

[PCMCIA] Fix oops in validate_mem when CONFIG_PCMCIA_PROBE=n

If I compile a recent 2.5.x kernel without CONFIG_ISA defined, I get
an oops in validate_mem().  Stack trace contains 0x6b6b6b6 - a clear
sign that freed memory is being accessed.

It's the second validate_mem() in drivers/pcmcia/rsrc_mgr.c - the one
used when CONFIG_PCMCIA_PROBE is not defined.  It turns out the memory
is freed in do_mem_probe() when it's called from validate_mem().

The solution is to use the same trick as in the first validate_mem().
This problem is quite serious and it's not specific to the plx9052
driver. I see it with yenta_socket as well.
parent 56d6223f
...@@ -499,14 +499,16 @@ void validate_mem(socket_info_t *s) ...@@ -499,14 +499,16 @@ void validate_mem(socket_info_t *s)
void validate_mem(socket_info_t *s) void validate_mem(socket_info_t *s)
{ {
resource_map_t *m; resource_map_t *m, *n;
static int done = 0; static int done = 0;
if (probe_mem && done++ == 0) { if (probe_mem && done++ == 0) {
down(&rsrc_sem); down(&rsrc_sem);
for (m = mem_db.next; m != &mem_db; m = m->next) for (m = mem_db.next; m != &mem_db; m = n) {
n = m->next;
if (do_mem_probe(m->base, m->num, s)) if (do_mem_probe(m->base, m->num, s))
break; break;
}
up(&rsrc_sem); up(&rsrc_sem);
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment