Re: 2.6.3-bk5 isdn oops

[Francois Romieu <romieu@fr.zoreil.com>]

Dave Jones <davej@redhat.com> :
[...]
> ISDN subsystem Rev: 1.1.2.3/1.1.2.3/1.1.2.2/1.1.2.3/1.1.2.2/1.1.2.2 loaded
> ICN-ISDN-driver Rev 1.65.6.8 mem=0x000d0000
> icn: (line0) ICN-2B, port 0x320 added
> Debug: sleeping function called from invalid context at include/linux/rwsem.h:43in_atomic():0, irqs_disabled():1
> Call Trace:
>  [<c0123214>] __might_sleep+0x80/0x8a
>  [<c011df07>] do_page_fault+0x71/0x46c
>  [<c7b0ffd7>] isdn_status_callback+0x8e0/0x968 [isdn]
>  [<c0121447>] schedule+0x5a6/0x631
>  [<c01213c8>] schedule+0x527/0x631
>  [<c011de96>] do_page_fault+0x0/0x46c
>  [<c010c165>] error_code+0x2d/0x38
>  [<c79aba66>] icn_exit+0xb4/0x155 [icn]

drivers/isdn/i4l/isdn_common.c
    745 isdn_status_callback(isdn_ctrl *c)
[...]
    767                 case ISDN_STAT_UNLOAD:
    768                         rc = fsm_event(&drv->fi, EV_STAT_UNLOAD, c);
[...]
    886         put_drv(drv);
                        ^^^ -> let's name this one "catherine"


drivers/isdn/i4l/isdn_common.c
    630 drv_stat_unload(struct fsm_inst *fi, int pr, void *arg)
[...]
    638         put_drv(drv);
                        ^^^ -> let's name this one "therese"

One has:
therese = catherine->fi->userdata

Given:

drivers/isdn/i4l/isdn_common.c
    896 register_isdn(isdn_if *iif)
[...]
    915         drv->fi.userdata = drv;

One checks that:
catherine = catherine->fi->userdata

So catherine = therese and there is a double put_drv() on the same pointer.
put_drv(drv)
-> drv_destroy(drv)
   -> kfree(drv->slots);

Oops.

--
Ueimor