fix for oops in plip driver

Kai Schulte (kai@eclipse.asta.uni-essen.de)
Tue, 5 Jan 1999 00:56:35 +0100 (CET)


THE BUG: configure the first parport without an interrupt but assign one
to the next. Then do

# modprobe plip
# rmmod plip
kmem_free: Bad obj addr (objp=c1c1bc70, name=size-32)
Unable to handle kernel NULL pointer dereference at virtual address 00000000
current->tss.cr3 = 01c3d000, ^_r3 = 01c3d000
*pde = 00000000
Oops: 0002
CPU: 0
EIP: 0010:[<c011f8a1>] [kfree]
...

The plip module increases its device count even if the module has not
been allocated successfully.

THE FIX:
=========================================================================
--- plip.c.orig Tue Dec 29 20:51:50 1998
+++ plip.c Tue Jan 5 00:29:47 1999
@@ -1227,7 +1227,6 @@
plip_init(void))
{
struct parport *pb = parport_enumerate();
- int devices=0;
int i=0;

if (parport[0] == -2)
@@ -1238,7 +1237,7 @@
timid = 0;
}

- /* When user feeds parameters, use them */
+ /* If the user feeds parameters, use them */
while (pb) {
if ((parport[0] == -1 && (!timid || !pb->devices)) ||
plip_searchfor(parport, i)) {
@@ -1266,14 +1265,13 @@
kfree(dev_plip[i]->name);
kfree(dev_plip[i]);
} else {
- devices++;
+ i++;
}
}
- i++;
pb = pb->next;
}

- if (devices == 0) {
+ if (i == 0) {
printk(KERN_INFO "plip: no devices registered\n");
return -EIO;
}
=========================================================================
one more fix that makes the code _smaller_ ;)

Kai

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/