diff options
| author | Pavel Roskin <proski@gnu.org> | 2011-07-22 22:07:13 (GMT) |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2011-07-26 20:27:31 (GMT) |
| commit | e61b52d1309df08b86a35e54a61f0cc932b28291 (patch) | |
| tree | 98bed4e7d4ec3a9b40be228e825eebee0e911aca /drivers/net | |
| parent | 6f89062a66d8b88ca89a15a6cebc0bc0db284441 (diff) | |
| download | linux-e61b52d1309df08b86a35e54a61f0cc932b28291.tar.xz | |
b43: fix invalid memory access in b43_ssb_remove()
wldev is freed in b43_one_core_detach() and should not be accessed after
that call. Keep wldev->dev in a local variable.
Signed-off-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/wireless/b43/main.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c index d9f53b7..85d6a1f 100644 --- a/drivers/net/wireless/b43/main.c +++ b/drivers/net/wireless/b43/main.c @@ -5350,6 +5350,7 @@ static void b43_ssb_remove(struct ssb_device *sdev) { struct b43_wl *wl = ssb_get_devtypedata(sdev); struct b43_wldev *wldev = ssb_get_drvdata(sdev); + struct b43_bus_dev *dev = wldev->dev; /* We must cancel any work here before unregistering from ieee80211, * as the ieee80211 unreg will destroy the workqueue. */ @@ -5365,14 +5366,14 @@ static void b43_ssb_remove(struct ssb_device *sdev) ieee80211_unregister_hw(wl->hw); } - b43_one_core_detach(wldev->dev); + b43_one_core_detach(dev); if (list_empty(&wl->devlist)) { b43_leds_unregister(wl); /* Last core on the chip unregistered. * We can destroy common struct b43_wl. */ - b43_wireless_exit(wldev->dev, wl); + b43_wireless_exit(dev, wl); } } |