Re: [Ndiswrapper-general] Instability after ndiswrapper unload with USB drivers

[Pavel R. <pr...@gn...>]

Quoting Pavel Roskin <pr...@gn...>:

> I think I have the culprit now.  I just don't have a fix.  In some
> cases, a urb can be freed twice.  First it's freed by the Linux USB
> code in usb_deregister() and then it's freed by our kill_all_urbs().
> Freeing a URB twice for the second time leads to decreasing the first
> byte of the freed memory by one.  That's where the reference count is
> located.

The fix was to remove usb_init_urb(), which is wrong to use on URBs  
allocated by usb_alloc_urb().  usb_init_urb() was resetting URB  
refcount from 2 to 1, which caused freeing the URB twice.

The fix has been committed.

-- 
Regards,
Pavel Roskin