Skip to content

Commit

Permalink
mwifiex: reset card->adapter during device unregister
Browse files Browse the repository at this point in the history
card->adapter gets initialized in mwifiex_register_dev(). As it's not
cleared in mwifiex_unregister_dev(), we may end up accessing the memory
which is already free in below scenario.

Scenario: Driver initialization is failed due to incorrect firmware or
some other reason. Meanwhile device reboot/unload occurs.

This is safe, now that we've properly synchronized suspend() and
remove() with the FW initialization thread; now that code can simply
check for 'card->adapter == NULL' and exit safely.

Signed-off-by: Xinming Hu <huxm@marvell.com>
Tested-by: Xinming Hu <huxm@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  • Loading branch information
Xinming Hu authored and Kalle Valo committed Nov 19, 2016
1 parent b42dbb2 commit bcf28a2
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 0 deletions.
1 change: 1 addition & 0 deletions drivers/net/wireless/marvell/mwifiex/pcie.c
Original file line number Diff line number Diff line change
Expand Up @@ -3042,6 +3042,7 @@ static void mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
if (card->msi_enable)
pci_disable_msi(pdev);
}
card->adapter = NULL;
}
}

Expand Down
1 change: 1 addition & 0 deletions drivers/net/wireless/marvell/mwifiex/sdio.c
Original file line number Diff line number Diff line change
Expand Up @@ -2017,6 +2017,7 @@ mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
struct sdio_mmc_card *card = adapter->card;

if (adapter->card) {
card->adapter = NULL;
sdio_claim_host(card->func);
sdio_disable_func(card->func);
sdio_release_host(card->func);
Expand Down

0 comments on commit bcf28a2

Please sign in to comment.