Re: [PATCH] Reset file->f_op in snd_card_file_remove(). Take 2

[Karsten Wiese <annabellesgarden@yahoo.de>]

Am Mittwoch, 4. Oktober 2006 11:22 schrieb Takashi Iwai:
> 
> It should call snd_card_free_when_closed() instead.
> 
IMHO, that would just make sure that the bug happens.
Please see my annotations, starting with // in:

void fastcall __fput(struct file *file)
{
	struct dentry *dentry = file->f_dentry;
	struct vfsmount *mnt = file->f_vfsmnt;
	struct inode *inode = dentry->d_inode;

	might_sleep();

	fsnotify_close(file);
	/*
	 * The function eventpoll_release() should be the first called
	 * in the file cleanup chain.
	 */
	eventpoll_release(file);
	locks_remove_flock(file);

	if (file->f_op && file->f_op->release)
		file->f_op->release(inode, file);
// Here snd_hwdep_release() is called.
// snd_hwdep_release() calls snd_card_file_remove().
// snd_card_file_remove() sees card->free_on_last_close ist set,
// calls snd_card_do_free().
// snd_card_do_free frees file->f_op but doesn't set it NULL.
//
	security_file_free(file);
	if (unlikely(inode->i_cdev != NULL))
		cdev_put(inode->i_cdev);
	fops_put(file->f_op);
// file->f_op has already been freeed!
// fops_put(file->f_op) is likely to oops.
//
	if (file->f_mode & FMODE_WRITE)
		put_write_access(inode);
	file_kill(file);
	file->f_dentry = NULL;
	file->f_vfsmnt = NULL;
	file_free(file);
	dput(dentry);
	mntput(mnt);
}

Right or wrong?

      Karsten

	

	
		
___________________________________________________________ 
Der frühe Vogel fängt den Wurm. Hier gelangen Sie zum neuen Yahoo! Mail: http://mail.yahoo.de


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV