[PATCH] aic7xxx timer deletion fix

From: Zwane Mwaikambo <zwane@linuxpower.ca>

ahc_linux_free_device() needs to use del_timer_sync().  slab corruption has
been observed due to the timer handler running after the containing object
was freed.

diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm.c b/drivers/scsi/aic7xxx/aic7xxx_osm.c
index 894238bf3398931fc55e8ecea5f6b0053861466a..2e32a59cbf700d6dfe34e917c241a1d5ffb57f9f 100644 (file)
--- a/drivers/scsi/aic7xxx/aic7xxx_osm.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_osm.c
@@ -4097,7 +4097,7 @@ ahc_linux_free_device(struct ahc_softc *ahc, struct ahc_linux_device *dev)
 {
        struct ahc_linux_target *targ;
 
-       del_timer(&dev->timer);
+       del_timer_sync(&dev->timer);
        targ = dev->target;
        targ->devices[dev->lun] = NULL;
        free(dev, M_DEVBUF);