Commit e899a3f2 authored by Michael Buesch's avatar Michael Buesch Committed by John W. Linville
Browse files

b43: Don't abuse wl->current_dev in the led work 



Don't abuse wl->current_dev in the LED work for checking whether we're
going down. Add an explicit variable.
This fixes a crash on rmmod dereferencing the wl->current_dev NULL pointer
in various other places of the driver.

Signed-off-by: default avatarMichael Buesch <mb@bu3sch.de>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 9308779a

drivers/net/wireless/b43/leds.c

+3 −4
Original line number Diff line number Diff line
@@ -112,10 +112,7 @@ static void b43_led_brightness_set(struct led_classdev *led_dev, 
	struct b43_led *led = container_of(led_dev, struct b43_led, led_dev);

	struct b43_wl *wl = led->wl;



	/* The check for current_dev is only needed while unregistering,

	 * so it is sequencial and does not race. But we must not dereference

	 * current_dev here. */

	if (likely(wl->current_dev)) {

	if (likely(!wl->leds.stop)) {

		atomic_set(&led->state, brightness);

		ieee80211_queue_work(wl->hw, &wl->leds.work);

	}
@@ -314,6 +311,8 @@ void b43_leds_init(struct b43_wldev *dev) 
			break;

		}

	}



	dev->wl->leds.stop = 0;

}



void b43_leds_exit(struct b43_wldev *dev)

drivers/net/wireless/b43/leds.h

+1 −0
Original line number Diff line number Diff line
@@ -35,6 +35,7 @@ struct b43_leds { 
	struct b43_led led_radio;

	struct b43_led led_assoc;



	bool stop;

	struct work_struct work;

};

drivers/net/wireless/b43/main.c

+1 −1
Original line number Diff line number Diff line
@@ -4987,7 +4987,7 @@ static void b43_remove(struct ssb_device *dev) 
		 * might have modified it. Restoring is important, so the networking

		 * stack can properly free resources. */

		wl->hw->queues = wl->mac80211_initially_registered_queues;

		wl->current_dev = NULL;

		wl->leds.stop = 1;

		cancel_work_sync(&wl->leds.work);

		ieee80211_unregister_hw(wl->hw);

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE