Commit a22fcf63 authored by Pavel Roskin's avatar Pavel Roskin Committed by Russell King

[PATCH] Fix crash when unloading yenta_socket in Linux 2.5.69

socket->base is unmapped in yenta_close(), which is called by
cardbus_remove().  The value of socket->base is not changed to
NULL, so it becomes invalid.

Then cardbus_remove() calls class_device_unregister(), which calls
pcmcia_unregister_socket(), which it turn tries to access memory
space of the socket.
parent 201313f5
......@@ -196,9 +196,9 @@ static void __devexit cardbus_remove (struct pci_dev *dev)
pci_socket_t *socket = pci_get_drvdata(dev);
/* note: we are already unregistered from the cs core */
class_device_unregister(&socket->cls_d.class_dev);
if (socket->op && socket->op->close)
socket->op->close(socket);
class_device_unregister(&socket->cls_d.class_dev);
pci_set_drvdata(dev, NULL);
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment