Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4e9aa52e authored by Zhu Yi's avatar Zhu Yi Committed by John W. Linville
Browse files

iwmc3200wifi: fix potential kernel oops on module removal 



The iwm_if_free() is called before destroy_workqueue for isr_wq on
device remove method. But if there is still some pending work in
the isr_wq, the required data structures are already freed at this
point. This leeds a kernel oops. The patch fixes this problem by
moving iwm_if_free after destroy_workqueue.

Signed-off-by: default avatarZhu Yi <yi.zhu@intel.com>
Signed-off-by: default avatarSamuel Ortiz <samuel.ortiz@intel.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent d7e057dc

drivers/net/wireless/iwmc3200wifi/sdio.c

+2 −2
Original line number Diff line number Diff line
@@ -479,10 +479,10 @@ static void iwm_sdio_remove(struct sdio_func *func) 
	struct iwm_priv *iwm = hw_to_iwm(hw);

	struct device *dev = &func->dev;



	iwm_debugfs_exit(iwm);

	iwm_if_remove(iwm);

	iwm_if_free(iwm);

	destroy_workqueue(hw->isr_wq);

	iwm_debugfs_exit(iwm);

	iwm_if_free(iwm);



	sdio_set_drvdata(func, NULL);