Fix SLAB corruption during

At rmmod stage, the code path is the following one :

rt2x00lib_remove_dev
-> rt2x00lib_uninitialize()

        -> rt2x00rfkill_unregister()
             -> rfkill_unregister()
        -> rt2x00rfkill_free()
             -> rfkill_free()

The problem is that rfkill_free should not be called after rfkill_free otherwise put_device(&rfkill->dev) will be called 2 times. This patch fix this by removing the call to rfkill_free

Signed-off-by Gertjan van Wingerde <[email protected]>

Tested-by Arnaud Patard <[email protected]>

Signed-off-by Ivo van Doorn <[email protected]>

---
John, this patch is for 2.6.29 and only 2.6.29 since rfkill support itself was removed from later versions (replaced by input_polldev).
The patch is quite big to be merged in a late state of the release cycle, but since the SLAB corruption is a serious problem, I hope this can get in regardless.

Thanks.

drivers/net/wireless/rt2x00/rt2x00.h +1 -2

index 39ecf3b..820fdb2 100644
@@ -687,8 +687,7 @@ struct rt2x00_dev {
 	 */
 #ifdef CONFIG_RT2X00_LIB_RFKILL
 	unsigned long rfkill_state;
-#define RFKILL_STATE_ALLOCATED		1
-#define RFKILL_STATE_REGISTERED		2
+#define RFKILL_STATE_REGISTERED		1
 	struct rfkill *rfkill;
 	struct delayed_work rfkill_work;
 #endif /* CONFIG_RT2X00_LIB_RFKILL */

drivers/net/wireless/rt2x00/rt2x00dev.c +0 -2

index 87c0f2c..e694bb7 100644
@@ -1105,7 +1105,6 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
 	 * Register extra components.
 	 */
 	rt2x00leds_register(rt2x00dev);
-	rt2x00rfkill_allocate(rt2x00dev);
 	rt2x00debug_register(rt2x00dev);
 
 	set_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);

@@ -1137,7 +1136,6 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
 	 * Free extra components
 	 */
 	rt2x00debug_deregister(rt2x00dev);
-	rt2x00rfkill_free(rt2x00dev);
 	rt2x00leds_unregister(rt2x00dev);
 
 	/*

drivers/net/wireless/rt2x00/rt2x00lib.h +0 -10

index 86cd26f..49309d4 100644
@@ -260,8 +260,6 @@ static inline void rt2x00crypto_rx_insert_iv(struct sk_buff *skb,
 #ifdef CONFIG_RT2X00_LIB_RFKILL
 void rt2x00rfkill_register(struct rt2x00_dev *rt2x00dev);
 void rt2x00rfkill_unregister(struct rt2x00_dev *rt2x00dev);
-void rt2x00rfkill_allocate(struct rt2x00_dev *rt2x00dev);
-void rt2x00rfkill_free(struct rt2x00_dev *rt2x00dev);
 #else
 static inline void rt2x00rfkill_register(struct rt2x00_dev *rt2x00dev)
 {

@@ -270,14 +268,6 @@ static inline void rt2x00rfkill_register(struct rt2x00_dev *rt2x00dev)
 static inline void rt2x00rfkill_unregister(struct rt2x00_dev *rt2x00dev)
 {
 }
-
-static inline void rt2x00rfkill_allocate(struct rt2x00_dev *rt2x00dev)
-{
-}
-
-static inline void rt2x00rfkill_free(struct rt2x00_dev *rt2x00dev)
-{
-}
 #endif /* CONFIG_RT2X00_LIB_RFKILL */
 
 /*

drivers/net/wireless/rt2x00/rt2x00rfkill.c +39 -48

index 3298cae..08ffc6d 100644
@@ -94,14 +94,50 @@ static void rt2x00rfkill_poll(struct work_struct *work)
 			   &rt2x00dev->rfkill_work, RFKILL_POLL_INTERVAL);
 }
 
+static int rt2x00rfkill_allocate(struct rt2x00_dev *rt2x00dev)
+{
+	struct device *dev = wiphy_dev(rt2x00dev->hw->wiphy);
+
+	rt2x00dev->rfkill = rfkill_allocate(dev, RFKILL_TYPE_WLAN);
+	if (!rt2x00dev->rfkill)
+		return -ENOMEM;
+
+	rt2x00dev->rfkill->name = rt2x00dev->ops->name;
+	rt2x00dev->rfkill->data = rt2x00dev;
+	rt2x00dev->rfkill->toggle_radio = rt2x00rfkill_toggle_radio;
+	if (test_bit(CONFIG_SUPPORT_HW_BUTTON, &rt2x00dev->flags)) {
+		rt2x00dev->rfkill->get_state = rt2x00rfkill_get_state;
+		rt2x00dev->rfkill->state =
+			rt2x00dev->ops->lib->rfkill_poll(rt2x00dev) ?
+			    RFKILL_STATE_SOFT_BLOCKED : RFKILL_STATE_UNBLOCKED;
+	} else {
+		rt2x00dev->rfkill->state = RFKILL_STATE_UNBLOCKED;
+	}
+
+	INIT_DELAYED_WORK(&rt2x00dev->rfkill_work, rt2x00rfkill_poll);
+
+	return 0;
+}
+
+static void rt2x00rfkill_free(struct rt2x00_dev *rt2x00dev)
+{
+	rfkill_free(rt2x00dev->rfkill);
+	rt2x00dev->rfkill = NULL;
+}
+
 void rt2x00rfkill_register(struct rt2x00_dev *rt2x00dev)
 {
-	if (!test_bit(RFKILL_STATE_ALLOCATED, &rt2x00dev->rfkill_state) ||
-	    test_bit(RFKILL_STATE_REGISTERED, &rt2x00dev->rfkill_state))
+	if (test_bit(RFKILL_STATE_REGISTERED, &rt2x00dev->rfkill_state))
+		return;
+
+	if (rt2x00rfkill_allocate(rt2x00dev)) {
+		ERROR(rt2x00dev, "Failed to allocate rfkill handler.\n");
 		return;
+	}
 
 	if (rfkill_register(rt2x00dev->rfkill)) {
 		ERROR(rt2x00dev, "Failed to register rfkill handler.\n");
+		rt2x00rfkill_free(rt2x00dev);
 		return;
 	}
 

@@ -117,8 +153,7 @@ void rt2x00rfkill_register(struct rt2x00_dev *rt2x00dev)
 
 void rt2x00rfkill_unregister(struct rt2x00_dev *rt2x00dev)
 {
-	if (!test_bit(RFKILL_STATE_ALLOCATED, &rt2x00dev->rfkill_state) ||
-	    !test_bit(RFKILL_STATE_REGISTERED, &rt2x00dev->rfkill_state))
+	if (!test_bit(RFKILL_STATE_REGISTERED, &rt2x00dev->rfkill_state))
 		return;
 
 	cancel_delayed_work_sync(&rt2x00dev->rfkill_work);

@@ -127,46 +162,3 @@ void rt2x00rfkill_unregister(struct rt2x00_dev *rt2x00dev)
 
 	__clear_bit(RFKILL_STATE_REGISTERED, &rt2x00dev->rfkill_state);
 }
-
-void rt2x00rfkill_allocate(struct rt2x00_dev *rt2x00dev)
-{
-	struct device *dev = wiphy_dev(rt2x00dev->hw->wiphy);
-
-	if (test_bit(RFKILL_STATE_ALLOCATED, &rt2x00dev->rfkill_state))
-		return;
-
-	rt2x00dev->rfkill = rfkill_allocate(dev, RFKILL_TYPE_WLAN);
-	if (!rt2x00dev->rfkill) {
-		ERROR(rt2x00dev, "Failed to allocate rfkill handler.\n");
-		return;
-	}
-
-	__set_bit(RFKILL_STATE_ALLOCATED, &rt2x00dev->rfkill_state);
-
-	rt2x00dev->rfkill->name = rt2x00dev->ops->name;
-	rt2x00dev->rfkill->data = rt2x00dev;
-	rt2x00dev->rfkill->toggle_radio = rt2x00rfkill_toggle_radio;
-	if (test_bit(CONFIG_SUPPORT_HW_BUTTON, &rt2x00dev->flags)) {
-		rt2x00dev->rfkill->get_state = rt2x00rfkill_get_state;
-		rt2x00dev->rfkill->state =
-			rt2x00dev->ops->lib->rfkill_poll(rt2x00dev) ?
-			    RFKILL_STATE_SOFT_BLOCKED : RFKILL_STATE_UNBLOCKED;
-	} else {
-		rt2x00dev->rfkill->state = RFKILL_STATE_UNBLOCKED;
-	}
-
-	INIT_DELAYED_WORK(&rt2x00dev->rfkill_work, rt2x00rfkill_poll);
-
-	return;
-}
-
-void rt2x00rfkill_free(struct rt2x00_dev *rt2x00dev)
-{
-	if (!test_bit(RFKILL_STATE_ALLOCATED, &rt2x00dev->rfkill_state))
-		return;
-
-	cancel_delayed_work_sync(&rt2x00dev->rfkill_work);
-
-	rfkill_free(rt2x00dev->rfkill);
-	rt2x00dev->rfkill = NULL;
-}
--

To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Quoted 9 lines · Ivo van Doorn

At rmmod stage, the code path is the following one :

rt2x00lib_remove_dev
-> rt2x00lib_uninitialize()

        -> rt2x00rfkill_unregister()
             -> rfkill_unregister()
        -> rt2x00rfkill_free()
             -> rfkill_free()

Quoted 3 lines

The problem is that rfkill_free should not be called after rfkill_free otherwise put_device(&rfkill->dev) will be called 2 times. This patch fix this by removing the call to rfkill_free

Needs a better patch title :) During what? And I assume you mean "rfkill_free() should not be called after rfkill_unregister(), right?

Dan

Quoted 192 lines

Signed-off-by Gertjan van Wingerde <[email protected]>

Tested-by Arnaud Patard <[email protected]>

Signed-off-by Ivo van Doorn <[email protected]>

---
John, this patch is for 2.6.29 and only 2.6.29 since rfkill support itself was removed from later versions (replaced by input_polldev).
The patch is quite big to be merged in a late state of the release cycle, but since the SLAB corruption is a serious problem, I hope this can get in regardless.

Thanks.

drivers/net/wireless/rt2x00/rt2x00.h +1 -2

index 39ecf3b..820fdb2 100644
@@ -687,8 +687,7 @@ struct rt2x00_dev {
 	 */
 #ifdef CONFIG_RT2X00_LIB_RFKILL
 	unsigned long rfkill_state;
-#define RFKILL_STATE_ALLOCATED		1
-#define RFKILL_STATE_REGISTERED		2
+#define RFKILL_STATE_REGISTERED		1
 	struct rfkill *rfkill;
 	struct delayed_work rfkill_work;
 #endif /* CONFIG_RT2X00_LIB_RFKILL */

drivers/net/wireless/rt2x00/rt2x00dev.c +0 -2

index 87c0f2c..e694bb7 100644
@@ -1105,7 +1105,6 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
 	 * Register extra components.
 	 */
 	rt2x00leds_register(rt2x00dev);
-	rt2x00rfkill_allocate(rt2x00dev);
 	rt2x00debug_register(rt2x00dev);
 
 	set_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);

@@ -1137,7 +1136,6 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
 	 * Free extra components
 	 */
 	rt2x00debug_deregister(rt2x00dev);
-	rt2x00rfkill_free(rt2x00dev);
 	rt2x00leds_unregister(rt2x00dev);
 
 	/*

drivers/net/wireless/rt2x00/rt2x00lib.h +0 -10

index 86cd26f..49309d4 100644
@@ -260,8 +260,6 @@ static inline void rt2x00crypto_rx_insert_iv(struct sk_buff *skb,
 #ifdef CONFIG_RT2X00_LIB_RFKILL
 void rt2x00rfkill_register(struct rt2x00_dev *rt2x00dev);
 void rt2x00rfkill_unregister(struct rt2x00_dev *rt2x00dev);
-void rt2x00rfkill_allocate(struct rt2x00_dev *rt2x00dev);
-void rt2x00rfkill_free(struct rt2x00_dev *rt2x00dev);
 #else
 static inline void rt2x00rfkill_register(struct rt2x00_dev *rt2x00dev)
 {

@@ -270,14 +268,6 @@ static inline void rt2x00rfkill_register(struct rt2x00_dev *rt2x00dev)
 static inline void rt2x00rfkill_unregister(struct rt2x00_dev *rt2x00dev)
 {
 }
-
-static inline void rt2x00rfkill_allocate(struct rt2x00_dev *rt2x00dev)
-{
-}
-
-static inline void rt2x00rfkill_free(struct rt2x00_dev *rt2x00dev)
-{
-}
 #endif /* CONFIG_RT2X00_LIB_RFKILL */
 
 /*

drivers/net/wireless/rt2x00/rt2x00rfkill.c +39 -48

index 3298cae..08ffc6d 100644
@@ -94,14 +94,50 @@ static void rt2x00rfkill_poll(struct work_struct *work)
 			   &rt2x00dev->rfkill_work, RFKILL_POLL_INTERVAL);
 }
 
+static int rt2x00rfkill_allocate(struct rt2x00_dev *rt2x00dev)
+{
+	struct device *dev = wiphy_dev(rt2x00dev->hw->wiphy);
+
+	rt2x00dev->rfkill = rfkill_allocate(dev, RFKILL_TYPE_WLAN);
+	if (!rt2x00dev->rfkill)
+		return -ENOMEM;
+
+	rt2x00dev->rfkill->name = rt2x00dev->ops->name;
+	rt2x00dev->rfkill->data = rt2x00dev;
+	rt2x00dev->rfkill->toggle_radio = rt2x00rfkill_toggle_radio;
+	if (test_bit(CONFIG_SUPPORT_HW_BUTTON, &rt2x00dev->flags)) {
+		rt2x00dev->rfkill->get_state = rt2x00rfkill_get_state;
+		rt2x00dev->rfkill->state =
+			rt2x00dev->ops->lib->rfkill_poll(rt2x00dev) ?
+			    RFKILL_STATE_SOFT_BLOCKED : RFKILL_STATE_UNBLOCKED;
+	} else {
+		rt2x00dev->rfkill->state = RFKILL_STATE_UNBLOCKED;
+	}
+
+	INIT_DELAYED_WORK(&rt2x00dev->rfkill_work, rt2x00rfkill_poll);
+
+	return 0;
+}
+
+static void rt2x00rfkill_free(struct rt2x00_dev *rt2x00dev)
+{
+	rfkill_free(rt2x00dev->rfkill);
+	rt2x00dev->rfkill = NULL;
+}
+
 void rt2x00rfkill_register(struct rt2x00_dev *rt2x00dev)
 {
-	if (!test_bit(RFKILL_STATE_ALLOCATED, &rt2x00dev->rfkill_state) ||
-	    test_bit(RFKILL_STATE_REGISTERED, &rt2x00dev->rfkill_state))
+	if (test_bit(RFKILL_STATE_REGISTERED, &rt2x00dev->rfkill_state))
+		return;
+
+	if (rt2x00rfkill_allocate(rt2x00dev)) {
+		ERROR(rt2x00dev, "Failed to allocate rfkill handler.\n");
 		return;
+	}
 
 	if (rfkill_register(rt2x00dev->rfkill)) {
 		ERROR(rt2x00dev, "Failed to register rfkill handler.\n");
+		rt2x00rfkill_free(rt2x00dev);
 		return;
 	}
 

@@ -117,8 +153,7 @@ void rt2x00rfkill_register(struct rt2x00_dev *rt2x00dev)
 
 void rt2x00rfkill_unregister(struct rt2x00_dev *rt2x00dev)
 {
-	if (!test_bit(RFKILL_STATE_ALLOCATED, &rt2x00dev->rfkill_state) ||
-	    !test_bit(RFKILL_STATE_REGISTERED, &rt2x00dev->rfkill_state))
+	if (!test_bit(RFKILL_STATE_REGISTERED, &rt2x00dev->rfkill_state))
 		return;
 
 	cancel_delayed_work_sync(&rt2x00dev->rfkill_work);

@@ -127,46 +162,3 @@ void rt2x00rfkill_unregister(struct rt2x00_dev *rt2x00dev)
 
 	__clear_bit(RFKILL_STATE_REGISTERED, &rt2x00dev->rfkill_state);
 }
-
-void rt2x00rfkill_allocate(struct rt2x00_dev *rt2x00dev)
-{
-	struct device *dev = wiphy_dev(rt2x00dev->hw->wiphy);
-
-	if (test_bit(RFKILL_STATE_ALLOCATED, &rt2x00dev->rfkill_state))
-		return;
-
-	rt2x00dev->rfkill = rfkill_allocate(dev, RFKILL_TYPE_WLAN);
-	if (!rt2x00dev->rfkill) {
-		ERROR(rt2x00dev, "Failed to allocate rfkill handler.\n");
-		return;
-	}
-
-	__set_bit(RFKILL_STATE_ALLOCATED, &rt2x00dev->rfkill_state);
-
-	rt2x00dev->rfkill->name = rt2x00dev->ops->name;
-	rt2x00dev->rfkill->data = rt2x00dev;
-	rt2x00dev->rfkill->toggle_radio = rt2x00rfkill_toggle_radio;
-	if (test_bit(CONFIG_SUPPORT_HW_BUTTON, &rt2x00dev->flags)) {
-		rt2x00dev->rfkill->get_state = rt2x00rfkill_get_state;
-		rt2x00dev->rfkill->state =
-			rt2x00dev->ops->lib->rfkill_poll(rt2x00dev) ?
-			    RFKILL_STATE_SOFT_BLOCKED : RFKILL_STATE_UNBLOCKED;
-	} else {
-		rt2x00dev->rfkill->state = RFKILL_STATE_UNBLOCKED;
-	}
-
-	INIT_DELAYED_WORK(&rt2x00dev->rfkill_work, rt2x00rfkill_poll);
-
-	return;
-}
-
-void rt2x00rfkill_free(struct rt2x00_dev *rt2x00dev)
-{
-	if (!test_bit(RFKILL_STATE_ALLOCATED, &rt2x00dev->rfkill_state))
-		return;
-
-	cancel_delayed_work_sync(&rt2x00dev->rfkill_work);
-
-	rfkill_free(rt2x00dev->rfkill);
-	rt2x00dev->rfkill = NULL;
-}
--

To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

At rmmod stage, the code path is the following one :
=20
rt2x00lib_remove_dev
=A0 -> =A0rt2x00lib_uninitialize()
=A0 =A0 =A0 =A0 -> rt2x00rfkill_unregister()
=A0 =A0 =A0 =A0 =A0 =A0 =A0-> rfkill_unregister()
=A0 =A0 =A0 =A0 -> rt2x00rfkill_free()
=A0 =A0 =A0 =A0 =A0 =A0 =A0-> rfkill_free()
=20
The problem is that rfkill_free should not be called after rfkill_reg=

otherwise put_device(&rfkill->dev) will be called 2 times. This patch fixes this by only calling rt2x00rfkill_free() when rt2x00rfkill_regi=

hasn't been called or has failed.
=20

Signed-off-by Gertjan van Wingerde <[email protected]>

Tested-by Arnaud Patard <[email protected]>

Signed-off-by Ivo van Doorn <[email protected]>

=20
---
John, this patch is for 2.6.29 and only 2.6.29 since rfkill support i=

was removed from later versions (replaced by input_polldev). The patch is quite big to be merged in a late state of the release cy=

but since the SLAB corruption is a serious problem, I hope this can g=

Quoted 10 lines · Ivo van Doorn

At rmmod stage, the code path is the following one :
=20
rt2x00lib_remove_dev
=A0 -> =A0rt2x00lib_uninitialize()
=A0 =A0 =A0 =A0 -> rt2x00rfkill_unregister()
=A0 =A0 =A0 =A0 =A0 =A0 =A0-> rfkill_unregister()
=A0 =A0 =A0 =A0 -> rt2x00rfkill_free()
=A0 =A0 =A0 =A0 =A0 =A0 =A0-> rfkill_free()
=20
The problem is that rfkill_free should not be called after rfkill_r=

Quoted 1 line

otherwise put_device(&rfkill->dev) will be called 2 times. This pat=

Quoted 1 line

fixes this by only calling rt2x00rfkill_free() when rt2x00rfkill_re=

Quoted 8 lines

hasn't been called or has failed.
=20

Signed-off-by Gertjan van Wingerde <[email protected]>

Tested-by Arnaud Patard <[email protected]>

Signed-off-by Ivo van Doorn <[email protected]>

=20
---
John, this patch is for 2.6.29 and only 2.6.29 since rfkill support=

Quoted 2 lines

was removed from later versions (replaced by input_polldev). The patch is quite big to be merged in a late state of the release =

Quoted 1 line

but since the SLAB corruption is a serious problem, I hope this can=

=20
Could you send me a version of this that applies on top of wireless-testing?

Also, is there a bug report somewhere that describes this issue this addresses?

Quoted 11 lines · John W. Linville

Quoted 10 lines · Ivo van Doorn

At rmmod stage, the code path is the following one :
=20
rt2x00lib_remove_dev
=A0 -> =A0rt2x00lib_uninitialize()
=A0 =A0 =A0 =A0 -> rt2x00rfkill_unregister()
=A0 =A0 =A0 =A0 =A0 =A0 =A0-> rfkill_unregister()
=A0 =A0 =A0 =A0 -> rt2x00rfkill_free()
=A0 =A0 =A0 =A0 =A0 =A0 =A0-> rfkill_free()
=20
The problem is that rfkill_free should not be called after rfkill=

Quoted 1 line

Quoted 1 line

otherwise put_device(&rfkill->dev) will be called 2 times. This p=

Quoted 1 line

Quoted 1 line

fixes this by only calling rt2x00rfkill_free() when rt2x00rfkill_=

Quoted 8 lines

Quoted 8 lines

hasn't been called or has failed.
=20

Signed-off-by Gertjan van Wingerde <[email protected]>

Tested-by Arnaud Patard <[email protected]>

Signed-off-by Ivo van Doorn <[email protected]>

=20
---
John, this patch is for 2.6.29 and only 2.6.29 since rfkill suppo=

Quoted 2 lines

Quoted 2 lines

was removed from later versions (replaced by input_polldev). The patch is quite big to be merged in a late state of the releas=

Quoted 1 line

Quoted 1 line

but since the SLAB corruption is a serious problem, I hope this c=

Quoted 3 lines

=20
Could you send me a version of this that applies on top of wireless-testing?

=20
Actually no, the code isn't present at all in wireless-testing. As I said, after 2.6.29 the entire rfkill structure is removed from r=

and replaced by input_polldev.

Quoted 12 lines · Ivo van Doorn

Quoted 11 lines · John W. Linville

Quoted 10 lines · Ivo van Doorn

At rmmod stage, the code path is the following one :
=20
rt2x00lib_remove_dev
=A0 -> =A0rt2x00lib_uninitialize()
=A0 =A0 =A0 =A0 -> rt2x00rfkill_unregister()
=A0 =A0 =A0 =A0 =A0 =A0 =A0-> rfkill_unregister()
=A0 =A0 =A0 =A0 -> rt2x00rfkill_free()
=A0 =A0 =A0 =A0 =A0 =A0 =A0-> rfkill_free()
=20
The problem is that rfkill_free should not be called after rfki=

Quoted 1 line

Quoted 1 line

Quoted 1 line

otherwise put_device(&rfkill->dev) will be called 2 times. This=

Quoted 1 line

Quoted 1 line

Quoted 1 line

fixes this by only calling rt2x00rfkill_free() when rt2x00rfkil=

Quoted 8 lines

Quoted 8 lines

Quoted 8 lines

hasn't been called or has failed.
=20

Signed-off-by Gertjan van Wingerde <[email protected]>

Tested-by Arnaud Patard <[email protected]>

Signed-off-by Ivo van Doorn <[email protected]>

=20
---
John, this patch is for 2.6.29 and only 2.6.29 since rfkill sup=

Quoted 2 lines

Quoted 2 lines

Quoted 2 lines

was removed from later versions (replaced by input_polldev). The patch is quite big to be merged in a late state of the rele=

Quoted 1 line

Quoted 1 line

Quoted 1 line

but since the SLAB corruption is a serious problem, I hope this=

Quoted 6 lines

Quoted 3 lines

=20
Could you send me a version of this that applies on top of wireless-testing?

=20
Actually no, the code isn't present at all in wireless-testing. As I said, after 2.6.29 the entire rfkill structure is removed from=

Quoted 1 line

and replaced by input_polldev.

=20
I guess I misunderstood. So just to be clear, no remnant or shadow of this patch should live-on to 2.6.30?

It's just that the merge conflicts created by this patch were awful. With 2.6.29's release presumably close, maybe this is a candidate for the stable tree?

Quoted 3 lines · John W. Linville

It's just that the merge conflicts created by this patch were awful. With 2.6.29's release presumably close, maybe this is a candidate for the stable tree?

That would be fine as well. :)
Should I resend it to -stable when 2.6.29 final is out?