Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e61b52d1 authored by Pavel Roskin's avatar Pavel Roskin Committed by John W. Linville
Browse files

b43: fix invalid memory access in b43_ssb_remove() 



wldev is freed in b43_one_core_detach() and should not be accessed after
that call.  Keep wldev->dev in a local variable.

Signed-off-by: default avatarPavel Roskin <proski@gnu.org>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 6f89062a

drivers/net/wireless/b43/main.c

+3 −2
Original line number Diff line number Diff line
@@ -5350,6 +5350,7 @@ static void b43_ssb_remove(struct ssb_device *sdev) 
{

	struct b43_wl *wl = ssb_get_devtypedata(sdev);

	struct b43_wldev *wldev = ssb_get_drvdata(sdev);

	struct b43_bus_dev *dev = wldev->dev;



	/* We must cancel any work here before unregistering from ieee80211,

	 * as the ieee80211 unreg will destroy the workqueue. */
@@ -5365,14 +5366,14 @@ static void b43_ssb_remove(struct ssb_device *sdev) 
		ieee80211_unregister_hw(wl->hw);

	}



	b43_one_core_detach(wldev->dev);

	b43_one_core_detach(dev);



	if (list_empty(&wl->devlist)) {

		b43_leds_unregister(wl);

		/* Last core on the chip unregistered.

		 * We can destroy common struct b43_wl.

		 */

		b43_wireless_exit(wldev->dev, wl);

		b43_wireless_exit(dev, wl);

	}

}