PATCH: fix for soundblaster module oops at rmmod time (fwd)

[Matthias Hanisch <matze@camline.com>]

[-- Attachment #1: Type: TEXT/PLAIN, Size: 1066 bytes --]

Hi!

Hopefully this is the right forum to report soundblaster-related bugs.
Please forward answers/questions also to me directly, I'm not subscribed
on the list.

Soundblaster module in version 2.4.10-pre9 and many (pre-)patches before
oopsed in sb_dsp_unload at the module deletion phase.

Loading the module reports

Sep 17 23:08:05 pingu kernel: <Sound Blaster (8 BIT/MONO ONLY) (2.01)> at
0x220 irq 5 dma 1>

so sb_mixer_init() is not called, because devc->major == 2.

Problem is that at "module deletion time", the call to sb_mixer_unload()
is unconditional and a

        kfree(mixer_devs[devc->my_mixerdev]);

is not very healthy if devc->my_mixerdev == -1 (the initial value).

This kfree() call without checking the array index got introduced in
2.4.8, sound_unload_mixerdev() which is called after kfree() contains a
check for devc->my_mixerdev != -1.

The attached patch cures this, it just introduces this check. It should
apply to any recent kernel.

Regards,
        Matze

-- 
Matthias Hanisch    mailto:matze@camline.com    phone: +49 8137 935-219


[-- Attachment #2: Type: TEXT/PLAIN, Size: 420 bytes --]

diff -ru linux/drivers/sound/sb_mixer.c linux-matze/drivers/sound/sb_mixer.c
--- linux/drivers/sound/sb_mixer.c	Mon Sep 17 23:36:38 2001
+++ linux-matze/drivers/sound/sb_mixer.c	Tue Sep 18 00:39:47 2001
@@ -748,6 +748,9 @@
 
 void sb_mixer_unload(sb_devc *devc)
 {
+	if (devc->my_mixerdev == -1)
+		return;
+
 	kfree(mixer_devs[devc->my_mixerdev]);
 	sound_unload_mixerdev(devc->my_mixerdev);
 	sbmixnum--;