Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ab5132a2 authored by Pavel Roskin's avatar Pavel Roskin Committed by John W. Linville
Browse files

ath9k: fix access to freed data on unload 



Calling ath_bus_cleanup() after ieee80211_free_hw() resulted in access
to common->bus_ops, which is already freed as part of the device data.

Remove the cleanup field in struct ath_bus_ops, as it was never used
properly.  Remove ath_bus_cleanup().  Merge cleanup functions in place
of the ath_bus_cleanup() calls.  Take care not to use any device data
after ieee80211_free_hw().

Signed-off-by: default avatarPavel Roskin <proski@gnu.org>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent e389900e

drivers/net/wireless/ath/ath.h

+0 −1
Original line number Diff line number Diff line
@@ -74,7 +74,6 @@ struct ath_common; 


struct ath_bus_ops {

	void		(*read_cachesize)(struct ath_common *common, int *csz);

	void		(*cleanup)(struct ath_common *common);

	bool		(*eeprom_read)(struct ath_common *common, u32 off, u16 *data);

	void		(*bt_coex_prep)(struct ath_common *common);

};

drivers/net/wireless/ath/ath9k/ahb.c

+2 −10
Original line number Diff line number Diff line
@@ -27,12 +27,6 @@ static void ath_ahb_read_cachesize(struct ath_common *common, int *csz) 
	*csz = L1_CACHE_BYTES >> 2;

}



static void ath_ahb_cleanup(struct ath_common *common)

{

	struct ath_softc *sc = (struct ath_softc *)common->priv;

	iounmap(sc->mem);

}



static bool ath_ahb_eeprom_read(struct ath_common *common, u32 off, u16 *data)

{

	struct ath_softc *sc = (struct ath_softc *)common->priv;
@@ -54,8 +48,6 @@ static bool ath_ahb_eeprom_read(struct ath_common *common, u32 off, u16 *data) 


static struct ath_bus_ops ath_ahb_bus_ops  = {

	.read_cachesize = ath_ahb_read_cachesize,

	.cleanup = ath_ahb_cleanup,



	.eeprom_read = ath_ahb_eeprom_read,

};
@@ -164,12 +156,12 @@ static int ath_ahb_remove(struct platform_device *pdev) 
	if (hw) {

		struct ath_wiphy *aphy = hw->priv;

		struct ath_softc *sc = aphy->sc;

		struct ath_common *common = ath9k_hw_common(sc->sc_ah);

		void __iomem *mem = sc->mem;



		ath9k_deinit_device(sc);

		free_irq(sc->irq, sc);

		ieee80211_free_hw(sc->hw);

		ath_bus_cleanup(common);

		iounmap(mem);

		platform_set_drvdata(pdev, NULL);

	}

drivers/net/wireless/ath/ath9k/ath9k.h

+0 −5
Original line number Diff line number Diff line
@@ -538,11 +538,6 @@ static inline void ath_read_cachesize(struct ath_common *common, int *csz) 
	common->bus_ops->read_cachesize(common, csz);

}



static inline void ath_bus_cleanup(struct ath_common *common)

{

	common->bus_ops->cleanup(common);

}



extern struct ieee80211_ops ath9k_ops;

extern int modparam_nohwcrypt;

drivers/net/wireless/ath/ath9k/pci.c

+5 −13
Original line number Diff line number Diff line
@@ -49,16 +49,6 @@ static void ath_pci_read_cachesize(struct ath_common *common, int *csz) 
		*csz = DEFAULT_CACHELINE >> 2;   /* Use the default size */

}



static void ath_pci_cleanup(struct ath_common *common)

{

	struct ath_softc *sc = (struct ath_softc *) common->priv;

	struct pci_dev *pdev = to_pci_dev(sc->dev);



	pci_iounmap(pdev, sc->mem);

	pci_disable_device(pdev);

	pci_release_region(pdev, 0);

}



static bool ath_pci_eeprom_read(struct ath_common *common, u32 off, u16 *data)

{

	struct ath_hw *ah = (struct ath_hw *) common->ah;
@@ -98,7 +88,6 @@ static void ath_pci_bt_coex_prep(struct ath_common *common) 


static const struct ath_bus_ops ath_pci_bus_ops = {

	.read_cachesize = ath_pci_read_cachesize,

	.cleanup = ath_pci_cleanup,

	.eeprom_read = ath_pci_eeprom_read,

	.bt_coex_prep = ath_pci_bt_coex_prep,

};
@@ -245,12 +234,15 @@ static void ath_pci_remove(struct pci_dev *pdev) 
	struct ieee80211_hw *hw = pci_get_drvdata(pdev);

	struct ath_wiphy *aphy = hw->priv;

	struct ath_softc *sc = aphy->sc;

	struct ath_common *common = ath9k_hw_common(sc->sc_ah);

	void __iomem *mem = sc->mem;



	ath9k_deinit_device(sc);

	free_irq(sc->irq, sc);

	ieee80211_free_hw(sc->hw);

	ath_bus_cleanup(common);



	pci_iounmap(pdev, mem);

	pci_disable_device(pdev);

	pci_release_region(pdev, 0);

}



#ifdef CONFIG_PM