From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1161129AbWBPPME (ORCPT ); Thu, 16 Feb 2006 10:12:04 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S932539AbWBPPMD (ORCPT ); Thu, 16 Feb 2006 10:12:03 -0500 Received: from cantor.suse.de ([195.135.220.2]:21708 "EHLO mx1.suse.de") by vger.kernel.org with ESMTP id S1161130AbWBPPMC (ORCPT ); Thu, 16 Feb 2006 10:12:02 -0500 Date: Thu, 16 Feb 2006 16:12:00 +0100 Message-ID: From: Takashi Iwai To: Cc: linux-kernel@vger.kernel.org Subject: Re: PROBLEM: "rmmod snd_cmipci" cause an Oops In-Reply-To: <43F4519F0005CE06.FFF7@mail.nnov.ru> References: <43F4519F0005CE06.FFF7@mail.nnov.ru> User-Agent: Wanderlust/2.12.0 (Your Wildest Dreams) SEMI/1.14.6 (Maruoka) FLIM/1.14.7 (=?ISO-8859-4?Q?Sanj=F2?=) APEL/10.6 MULE XEmacs/21.5 (beta21) (corn) (+CVS-20050720) (i386-suse-linux) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org At Thu, 16 Feb 2006 13:19:19 +0300 (MSK), wrote: > > > "rmmod snd_cmipci" cause an Oops. > Linux-2.6.14 does not have this bug. > > # rmmod snd_cmipci > Unable to handle kernel NULL pointer dereference at virtual address > 00000018 > printing eip: > c011b9da > *pde = 00000000 > Oops: 0000 [#1] > PREEMPT > Modules linked in: lp snd_cmipci snd_pcm_oss snd_mixer_oss snd_pcm > snd_page_alloc snd_opl3_lib snd_timer snd_hwdep > snd_mpu401_uart snd_rawmidi snd_seq_device snd soundcore pl2303 usbserial > ohci_hcd usbcore sis_agp agpgart nls_cp866 > vfat fat fuse parport_pc parport psmouse 8250 serial_core unix > CPU: 0 > EIP: 0060:[] Not tainted VLI > EFLAGS: 00010202 (2.6.15.4-gaa) > EIP is at __release_resource+0xa/0x50 > eax: 00000000 ebx: c145c000 ecx: 00000018 edx: c2f5f3a0 > esi: c2c7e540 edi: 00001fff ebp: c2c7e400 esp: c145de64 > ds: 007b es: 007b ss: 0068 > Process rmmod (pid: 2685, threadinfo=c145c000 task=c34d7560) > Stack: c011bae1 c2f5f3a0 c2f5f3a0 c2c7e540 c4a67914 c2f5f3a0 c3655400 > c49ed65f > c2f5f3a0 c2f5f3e0 c4a679fd c3655400 00001000 c4a67c72 c2c7e400 > c3655400 > c145c000 c2c7e400 c4a9c548 c4a9c548 c4a62de9 c2c7e400 00000001 > c01ec0cf > Call Trace: > [] release_resource+0x21/0x50 > [] release_and_free_resource+0x14/0x30 [snd] > [] snd_opl3_free+0x1f/0x40 [snd_opl3_lib] > [] snd_device_free+0x5d/0xb0 [snd] > [] snd_device_free_all+0x62/0x70 [snd] > [] snd_card_free+0x109/0x210 [snd] > [] kref_put+0x2f/0x80 > [] snd_cmipci_remove+0x19/0x24 [snd_cmipci] > [] pci_device_remove+0x1e/0x40 > [] __device_release_driver+0x62/0xa0 > [] driver_detach+0xa4/0xbe > [] bus_remove_driver+0x53/0x80 > [] driver_unregister+0x10/0x20 > [] pci_unregister_driver+0x13/0x20 > [] alsa_card_cmipci_exit+0xf/0x11 [snd_cmipci] > [] sys_delete_module+0x155/0x1a0 > [] sys_munmap+0x44/0x70 > [] syscall_call+0x7/0xb > Code: 0c c3 89 47 14 89 3a 89 77 10 31 f6 89 f0 8b 1c 24 8b 74 24 04 8b 7c > 24 08 83 c4 0c c3 8d 74 26 00 8b 54 24 04 8b > 42 10 8d 48 18 <8b> 40 18 85 c0 74 2f 39 c2 75 13 8b 42 14 89 01 31 c0 c7 > 42 10 > <6>note: rmmod[2685] exited with preempt_count 1 > Segmentation fault Likely fixed already in 2.6.16-rc by the patch below. Takashi [ALSA] opl3 - Fix the unreleased resources Modules: OPL3 Fix the unreleased resources in the error path of snd_opl3_create(). Signed-off-by: Takashi Iwai --- commit 676338a1623ee9b60a6efb19ef8f743ab3b2eecb tree 353750772b10adbfa8eed9a09fea94b72f8f55ad parent 3e23c658833f135508127c955d40d7c9387f71dd author Takashi Iwai Tue, 03 Jan 2006 19:56:55 +0100 committer Jaroslav Kysela Wed, 04 Jan 2006 10:13:52 +0100 sound/drivers/opl3/opl3_lib.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/sound/drivers/opl3/opl3_lib.c b/sound/drivers/opl3/opl3_lib.c index 650f3b8..1e0c76b 100644 --- a/sound/drivers/opl3/opl3_lib.c +++ b/sound/drivers/opl3/opl3_lib.c @@ -409,13 +409,13 @@ int snd_opl3_create(struct snd_card *car if (! integrated) { if ((opl3->res_l_port = request_region(l_port, 2, "OPL2/3 (left)")) == NULL) { snd_printk(KERN_ERR "opl3: can't grab left port 0x%lx\n", l_port); - snd_opl3_free(opl3); + snd_device_free(card, opl3); return -EBUSY; } if (r_port != 0 && (opl3->res_r_port = request_region(r_port, 2, "OPL2/3 (right)")) == NULL) { snd_printk(KERN_ERR "opl3: can't grab right port 0x%lx\n", r_port); - snd_opl3_free(opl3); + snd_device_free(card, opl3); return -EBUSY; } } @@ -434,7 +434,7 @@ int snd_opl3_create(struct snd_card *car if ((err = snd_opl3_detect(opl3)) < 0) { snd_printd("OPL2/3 chip not detected at 0x%lx/0x%lx\n", opl3->l_port, opl3->r_port); - snd_opl3_free(opl3); + snd_device_free(card, opl3); return err; } /* detect routine returns correct hardware type */