On 07/12/2025 01:16, Michal Pecio wrote: > Hi, > >>>> I got something. In my case everything seemed fine until I >>>> unplugged the wifi adapter. And then the system still worked for a >>>> few minutes before it froze. > > Sounds like memory corruption. > >>> Zenm and I tested below changes which can also reproduce the >>> symptom, so I wonder driver might assume urb is the first member of >>> struct, but unfortunately I can't find that. > > That's what it seems to be doing, because it uses usb_init_urb() > on urbs embedded in some struct and then usb_free_urb(). > > If you look what usb_free_urb() does, it decrements refcount and > attempts to free urb. But here urb is a member of a larger struct, > so I guess the whole struct is freed (and this was either intentional > or a bug that didn't happen to blow up yet). > > Now a bogus address is being passed to kfree() and things go boom. > Or at least that's my first guess after spending a few minutes. > But that's the direction I would be looking at. > > Regards, > Michal
Ahhh, I see it now, thank you.
