diff options
| author | Brian Norris | 2017-07-25 03:13:21 +0200 |
|---|---|---|
| committer | Kalle Valo | 2017-07-28 16:47:47 +0200 |
| commit | ce32d1d83702064e7746453622fc2d6bdcd8baa4 (patch) | |
| tree | 05cecd8052b6d54363b91b69e693f58089c3befc /drivers/net/wireless/marvell/mwifiex/main.c | |
| parent | mwifiex: re-register wiphy across reset (diff) | |
| download | kernel-qcow2-linux-ce32d1d83702064e7746453622fc2d6bdcd8baa4.tar.gz kernel-qcow2-linux-ce32d1d83702064e7746453622fc2d6bdcd8baa4.tar.xz kernel-qcow2-linux-ce32d1d83702064e7746453622fc2d6bdcd8baa4.zip | |
mwifiex: unregister wiphy before freeing resources
It's possible for some control interfaces (e.g., scans, set freq) to be
active after we've stopped our main work queue and the netif TX queues.
These don't get completely shut out until we've unregistered the wdevs
and wiphy.
So let's only free command buffers and poison our lists after
wiphy_unregister().
This resolves various use-after-free issues seen when resetting the
device.
Cc: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless/marvell/mwifiex/main.c')
| -rw-r--r-- | drivers/net/wireless/marvell/mwifiex/main.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c index 9c8f7bcfef8b..77e491720664 100644 --- a/drivers/net/wireless/marvell/mwifiex/main.c +++ b/drivers/net/wireless/marvell/mwifiex/main.c @@ -653,6 +653,7 @@ err_dnld_fw: if (adapter->hw_status == MWIFIEX_HW_STATUS_READY) { pr_debug("info: %s: shutdown mwifiex\n", __func__); mwifiex_shutdown_drv(adapter); + mwifiex_free_cmd_buffers(adapter); } init_failed = true; @@ -1404,11 +1405,13 @@ static void mwifiex_uninit_sw(struct mwifiex_adapter *adapter) mwifiex_del_virtual_intf(adapter->wiphy, &priv->wdev); rtnl_unlock(); } - vfree(adapter->chan_stats); wiphy_unregister(adapter->wiphy); wiphy_free(adapter->wiphy); adapter->wiphy = NULL; + + vfree(adapter->chan_stats); + mwifiex_free_cmd_buffers(adapter); } /* @@ -1515,6 +1518,7 @@ err_kmalloc: mwifiex_dbg(adapter, ERROR, "info: %s: shutdown mwifiex\n", __func__); mwifiex_shutdown_drv(adapter); + mwifiex_free_cmd_buffers(adapter); } complete_all(adapter->fw_done); @@ -1662,6 +1666,7 @@ err_registerdev: if (adapter->hw_status == MWIFIEX_HW_STATUS_READY) { pr_debug("info: %s: shutdown mwifiex\n", __func__); mwifiex_shutdown_drv(adapter); + mwifiex_free_cmd_buffers(adapter); } err_kmalloc: mwifiex_free_adapter(adapter); |