-
Russell King authored
If you perform the following commands in order: # cardctl eject # rmmod yenta_socket # insmod drivers/pcmcia/yenta_socket.ko # killall cardmgr the rmmod ends up freeing the pcmcia_bus_socket while the wait queue is still active. The killall cardmgr cases the the select() to complete, and users to be removed from the "queue" - which ends up writing to freed memory. The following patch adds refcounting to pcmcia_bus_socket so we won't free it until all users have gone. We also add "SOCKET_DEAD" to mark the condition where the socket is no longer present in the system. Note that we don't wake up cardmgr when we remove sockets - unfortunately cardmgr doesn't like receiving errors from read(). Really, cardmgr should treat EIO from read() as a fatal error for that socket, and stop listening for events from it.
3b32a7e7