[PATCH] at1700: fix double free_irq

[PATCH] at1700: fix double free_irq

[Kulikov Vasiliy]

free_irq() is called both in net_close() and cleanup_card().  Since it
is requested in at1700_probe1(), leave free_irq() only in cleanup_card()
for balance.

Signed-off-by: Kulikov Vasiliy <segooon@gmail.com>
---
 drivers/net/at1700.c |    4 +---
 1 files changed, 1 insertions(+), 3 deletions(-)

diff --git a/drivers/net/at1700.c b/drivers/net/at1700.c
index 93185f5..8987689 100644
--- a/drivers/net/at1700.c
+++ b/drivers/net/at1700.c
@@ -811,10 +811,8 @@ static int net_close(struct net_device *dev)
 	/* No statistic counters on the chip to update. */
 
 	/* Disable the IRQ on boards of fmv18x where it is feasible. */
-	if (lp->jumpered) {
+	if (lp->jumpered)
 		outb(0x00, ioaddr + IOCONFIG1);
-		free_irq(dev->irq, dev);
-	}
 
 	/* Power-down the chip.  Green, green, green! */
 	outb(0x00, ioaddr + CONFIG_1);
-- 
1.7.0.4

Re: [PATCH] at1700: fix double free_irq

[Dan Carpenter]

On Fri, Jul 09, 2010 at 04:31:26PM +0400, Kulikov Vasiliy wrote:
> free_irq() is called both in net_close() and cleanup_card().  Since it
> is requested in at1700_probe1(), leave free_irq() only in cleanup_card()
> for balance.
> 

Are you sure?  I would think that we should make the free_irq() in
cleanup_card() conditional instead.

> Signed-off-by: Kulikov Vasiliy <segooon@gmail.com>
> ---
>  drivers/net/at1700.c |    4 +---
>  1 files changed, 1 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/at1700.c b/drivers/net/at1700.c
> index 93185f5..8987689 100644
> --- a/drivers/net/at1700.c
> +++ b/drivers/net/at1700.c
> @@ -811,10 +811,8 @@ static int net_close(struct net_device *dev)
>  	/* No statistic counters on the chip to update. */
>  
>  	/* Disable the IRQ on boards of fmv18x where it is feasible. */
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

It seems like this comment should be updated?

> -	if (lp->jumpered) {
> +	if (lp->jumpered)
>  		outb(0x00, ioaddr + IOCONFIG1);
> -		free_irq(dev->irq, dev);
> -	}

regards,
dan carpenter

Re: [PATCH] at1700: fix double free_irq

[Kulikov Vasiliy]

On Fri, Jul 09, 2010 at 18:58 +0200, Dan Carpenter wrote:
> On Fri, Jul 09, 2010 at 04:31:26PM +0400, Kulikov Vasiliy wrote:
> > free_irq() is called both in net_close() and cleanup_card().  Since it
> > is requested in at1700_probe1(), leave free_irq() only in cleanup_card()
> > for balance.
> > 
> 
> Are you sure? I would think that we should make the free_irq() in
> cleanup_card() conditional instead.
See balanced functions: net_open() & net_close(), at1700_probe1() &
cleanup_card(). request_irq() is in probe, so it must not be
freed on 'ifconfig down'. E.g.

modprobe at1700 <== request_irq()
ifconfig eth0 up
ifconfig eth0 down <== first free_irq()
ifconfig eth0 up   <== no request_irq() here!
ifconfig eth0 down <== second free_irq()
rmmod at1700 <== third free_irq()

> 
> > Signed-off-by: Kulikov Vasiliy <segooon@gmail.com>
> > ---
> >  drivers/net/at1700.c |    4 +---
> >  1 files changed, 1 insertions(+), 3 deletions(-)
> > 
> > diff --git a/drivers/net/at1700.c b/drivers/net/at1700.c
> > index 93185f5..8987689 100644
> > --- a/drivers/net/at1700.c
> > +++ b/drivers/net/at1700.c
> > @@ -811,10 +811,8 @@ static int net_close(struct net_device *dev)
> >  	/* No statistic counters on the chip to update. */
> >  
> >  	/* Disable the IRQ on boards of fmv18x where it is feasible. */
>         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 
> It seems like this comment should be updated?

Maybe yes, but I don't know what these damn IO requests mean.
Sure, it's better to request IRQ in xxx_open(), but as it is already
done in probe() I leave it here.

If it is a bug then I do nothing with it, but if it is not then I'll
create a bug.

> 
> > -	if (lp->jumpered) {
> > +	if (lp->jumpered)
> >  		outb(0x00, ioaddr + IOCONFIG1);
> > -		free_irq(dev->irq, dev);
> > -	}
> 
> regards,
> dan carpenter

Re: [PATCH] at1700: fix double free_irq

[Dan Carpenter]

On Fri, Jul 09, 2010 at 09:48:09PM +0400, Kulikov Vasiliy wrote:
> > >  	/* Disable the IRQ on boards of fmv18x where it is feasible. */
> >         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > 
> > It seems like this comment should be updated?
> 
> Maybe yes, but I don't know what these damn IO requests mean.
> Sure, it's better to request IRQ in xxx_open(), but as it is already
> done in probe() I leave it here.
> 
> If it is a bug then I do nothing with it, but if it is not then I'll
> create a bug.
> 

Yeah.  I see what you mean.  You are probably right.  It should be easy
to test if anyone had the hardware.  But this driver is 17 years old so
I doubt anyone does.  :P

regards,
dan carpenter

Re: [PATCH] at1700: fix double free_irq

[David Miller]

From: Kulikov Vasiliy <segooon@gmail.com>
Date: Fri,  9 Jul 2010 16:31:26 +0400

> free_irq() is called both in net_close() and cleanup_card().  Since it
> is requested in at1700_probe1(), leave free_irq() only in cleanup_card()
> for balance.
> 
> Signed-off-by: Kulikov Vasiliy <segooon@gmail.com>

Applied.