Re: PROBLEM: "rmmod snd_cmipci" cause an Oops

[Takashi Iwai <tiwai@suse.de>]

At Thu, 16 Feb 2006 13:19:19 +0300 (MSK),
<gaa@mail.nnov.ru> wrote:
> 
> 
> "rmmod snd_cmipci" cause an Oops.
> Linux-2.6.14 does not have this bug.
> 
> # rmmod snd_cmipci
> Unable to handle kernel NULL pointer dereference at virtual address 
> 00000018
>  printing eip:
> c011b9da
> *pde = 00000000
> Oops: 0000 [#1]
> PREEMPT
> Modules linked in: lp snd_cmipci snd_pcm_oss snd_mixer_oss snd_pcm 
> snd_page_alloc snd_opl3_lib snd_timer snd_hwdep 
> snd_mpu401_uart snd_rawmidi snd_seq_device snd soundcore pl2303 usbserial 
> ohci_hcd usbcore sis_agp agpgart nls_cp866 
> vfat fat fuse parport_pc parport psmouse 8250 serial_core unix
> CPU:    0
> EIP:    0060:[<c011b9da>]    Not tainted VLI
> EFLAGS: 00010202   (2.6.15.4-gaa)
> EIP is at __release_resource+0xa/0x50
> eax: 00000000   ebx: c145c000   ecx: 00000018   edx: c2f5f3a0
> esi: c2c7e540   edi: 00001fff   ebp: c2c7e400   esp: c145de64
> ds: 007b   es: 007b   ss: 0068
> Process rmmod (pid: 2685, threadinfo=c145c000 task=c34d7560)
> Stack: c011bae1 c2f5f3a0 c2f5f3a0 c2c7e540 c4a67914 c2f5f3a0 c3655400 
> c49ed65f
>        c2f5f3a0 c2f5f3e0 c4a679fd c3655400 00001000 c4a67c72 c2c7e400 
> c3655400
>        c145c000 c2c7e400 c4a9c548 c4a9c548 c4a62de9 c2c7e400 00000001 
> c01ec0cf
> Call Trace:
>  [<c011bae1>] release_resource+0x21/0x50
>  [<c4a67914>] release_and_free_resource+0x14/0x30 [snd]
>  [<c49ed65f>] snd_opl3_free+0x1f/0x40 [snd_opl3_lib]
>  [<c4a679fd>] snd_device_free+0x5d/0xb0 [snd]
>  [<c4a67c72>] snd_device_free_all+0x62/0x70 [snd]
>  [<c4a62de9>] snd_card_free+0x109/0x210 [snd]
>  [<c01ec0cf>] kref_put+0x2f/0x80
>  [<c4a97bf9>] snd_cmipci_remove+0x19/0x24 [snd_cmipci]
>  [<c01f621e>] pci_device_remove+0x1e/0x40
>  [<c0227522>] __device_release_driver+0x62/0xa0
>  [<c0227634>] driver_detach+0xa4/0xbe
>  [<c0226e83>] bus_remove_driver+0x53/0x80
>  [<c0227950>] driver_unregister+0x10/0x20
>  [<c01f64a3>] pci_unregister_driver+0x13/0x20
>  [<c4a97c9f>] alsa_card_cmipci_exit+0xf/0x11 [snd_cmipci]
>  [<c0131425>] sys_delete_module+0x155/0x1a0
>  [<c014c9d4>] sys_munmap+0x44/0x70
>  [<c0102f21>] syscall_call+0x7/0xb
> Code: 0c c3 89 47 14 89 3a 89 77 10 31 f6 89 f0 8b 1c 24 8b 74 24 04 8b 7c 
> 24 08 83 c4 0c c3 8d 74 26 00 8b 54 24 04 8b 
> 42 10 8d 48 18 <8b> 40 18 85 c0 74 2f 39 c2 75 13 8b 42 14 89 01 31 c0 c7 
> 42 10
>  <6>note: rmmod[2685] exited with preempt_count 1
> Segmentation fault

Likely fixed already in 2.6.16-rc by the patch below.


Takashi


[ALSA] opl3 - Fix the unreleased resources

Modules: OPL3

Fix the unreleased resources in the error path of snd_opl3_create().

Signed-off-by: Takashi Iwai <tiwai@suse.de>

---
commit 676338a1623ee9b60a6efb19ef8f743ab3b2eecb
tree 353750772b10adbfa8eed9a09fea94b72f8f55ad
parent 3e23c658833f135508127c955d40d7c9387f71dd
author Takashi Iwai <tiwai@suse.de> Tue, 03 Jan 2006 19:56:55 +0100
committer Jaroslav Kysela <perex@suse.cz> Wed, 04 Jan 2006 10:13:52 +0100

 sound/drivers/opl3/opl3_lib.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/sound/drivers/opl3/opl3_lib.c b/sound/drivers/opl3/opl3_lib.c
index 650f3b8..1e0c76b 100644
--- a/sound/drivers/opl3/opl3_lib.c
+++ b/sound/drivers/opl3/opl3_lib.c
@@ -409,13 +409,13 @@ int snd_opl3_create(struct snd_card *car
 	if (! integrated) {
 		if ((opl3->res_l_port = request_region(l_port, 2, "OPL2/3 (left)")) == NULL) {
 			snd_printk(KERN_ERR "opl3: can't grab left port 0x%lx\n", l_port);
-			snd_opl3_free(opl3);
+			snd_device_free(card, opl3);
 			return -EBUSY;
 		}
 		if (r_port != 0 &&
 		    (opl3->res_r_port = request_region(r_port, 2, "OPL2/3 (right)")) == NULL) {
 			snd_printk(KERN_ERR "opl3: can't grab right port 0x%lx\n", r_port);
-			snd_opl3_free(opl3);
+			snd_device_free(card, opl3);
 			return -EBUSY;
 		}
 	}
@@ -434,7 +434,7 @@ int snd_opl3_create(struct snd_card *car
 		if ((err = snd_opl3_detect(opl3)) < 0) {
 			snd_printd("OPL2/3 chip not detected at 0x%lx/0x%lx\n",
 				   opl3->l_port, opl3->r_port);
-			snd_opl3_free(opl3);
+			snd_device_free(card, opl3);
 			return err;
 		}
 		/* detect routine returns correct hardware type */