[PATCH] [2.4] [2.5] Fix PPPoATM crash on disconnection

PPPoATM uses tasklet_disable() on a tasklet inside a struct and then
frees the struct, leaving a pointer to the freed tasklet inside tasklet
lists.

This patch replaces tasklet_disable() with tasklet_kill().

diff --git a/net/atm/pppoatm.c b/net/atm/pppoatm.c
index 48c41db8bf3e968ca95d32f8f383e11c45a2a21d..5ec53e6a73adbe29be52bab7e7d6cc4b1c2bbd07 100644 (file)
--- a/net/atm/pppoatm.c
+++ b/net/atm/pppoatm.c
@@ -125,7 +125,7 @@ static void pppoatm_unassign_vcc(struct atm_vcc *atmvcc)
        pvcc = atmvcc_to_pvcc(atmvcc);
        atmvcc->push = pvcc->old_push;
        atmvcc->pop = pvcc->old_pop;
-       tasklet_disable(&pvcc->wakeup_tasklet);
+       tasklet_kill(&pvcc->wakeup_tasklet);
        ppp_unregister_channel(&pvcc->chan);
        atmvcc->user_back = NULL;
        kfree(pvcc);