Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 560ce308 authored by Vladimir Kondratiev's avatar Vladimir Kondratiev Committed by John W. Linville
Browse files

wil6210: fix access after free in wil_pcie_remove() 



'wil'  released in wil_if_free(); save iomapped address aside to
properly unmap it.

Signed-off-by: default avatarVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 48e81a15

drivers/net/wireless/ath/wil6210/pcie_bus.c

+2 −1
Original line number Original line Diff line number Diff line
@@ -218,12 +218,13 @@ static int wil_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id) 
static void wil_pcie_remove(struct pci_dev *pdev)

static void wil_pcie_remove(struct pci_dev *pdev)

{

{

	struct wil6210_priv *wil = pci_get_drvdata(pdev);

	struct wil6210_priv *wil = pci_get_drvdata(pdev);

	void __iomem *csr = wil->csr;





	wil6210_debugfs_remove(wil);

	wil6210_debugfs_remove(wil);

	wil_if_pcie_disable(wil);

	wil_if_pcie_disable(wil);

	wil_if_remove(wil);

	wil_if_remove(wil);

	wil_if_free(wil);

	wil_if_free(wil);

	pci_iounmap(pdev, wil->csr);

	pci_iounmap(pdev, csr);

	pci_release_region(pdev, 0);

	pci_release_region(pdev, 0);

	pci_disable_device(pdev);

	pci_disable_device(pdev);

}

}