From: Zwane Mwaikambo <zwane@linuxpower.ca>

ahc_linux_free_device() needs to use del_timer_sync().  slab corruption has
been observed due to the timer handler running after the containing object
was freed.



 drivers/scsi/aic7xxx/aic7xxx_osm.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

diff -puN drivers/scsi/aic7xxx/aic7xxx_osm.c~adaptec-del_timer_sync drivers/scsi/aic7xxx/aic7xxx_osm.c
--- 25/drivers/scsi/aic7xxx/aic7xxx_osm.c~adaptec-del_timer_sync	2003-04-02 22:51:19.000000000 -0800
+++ 25-akpm/drivers/scsi/aic7xxx/aic7xxx_osm.c	2003-04-02 22:51:19.000000000 -0800
@@ -4097,7 +4097,7 @@ ahc_linux_free_device(struct ahc_softc *
 {
 	struct ahc_linux_target *targ;
 
-	del_timer(&dev->timer);
+	del_timer_sync(&dev->timer);
 	targ = dev->target;
 	targ->devices[dev->lun] = NULL;
 	free(dev, M_DEVBUF);

_