diff options
| author | Amitkumar Karwar <akarwar@marvell.com> | 2013-05-17 17:50:19 -0700 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2013-05-22 15:08:47 -0400 |
| commit | 06041118ef0908b9cae7657a7b734699bcf61a6c (patch) | |
| tree | f6b74fb5f394c2997a94793318fa18efa7e2b069 /drivers/net/wireless/mwifiex | |
| parent | c56ecf5a7f0f670c0c445a3d2d0bd6c3eda7015c (diff) | |
| download | op-kernel-dev-06041118ef0908b9cae7657a7b734699bcf61a6c.zip op-kernel-dev-06041118ef0908b9cae7657a7b734699bcf61a6c.tar.gz | |
mwifiex: scan delay timer cleanup in unload path
Return from scan delay timer routine if surprise_removed flag
is true. Also, cancel the timer in unload path.
This fixes a crash when scan delay timer accesses structures
that have been freed already.
Tested with "iwlist mlan0 scan & sleep 1; rmmod mwifiex_sdio"
Reported-by: Daniel Drake <dsd@laptop.org>
Tested-by: Daniel Drake <dsd@laptop.org>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/mwifiex')
| -rw-r--r-- | drivers/net/wireless/mwifiex/init.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c index 58e151e..71bbf12 100644 --- a/drivers/net/wireless/mwifiex/init.c +++ b/drivers/net/wireless/mwifiex/init.c @@ -59,6 +59,9 @@ static void scan_delay_timer_fn(unsigned long data) struct cmd_ctrl_node *cmd_node, *tmp_node; unsigned long flags; + if (adapter->surprise_removed) + return; + if (adapter->scan_delay_cnt == MWIFIEX_MAX_SCAN_DELAY_CNT) { /* * Abort scan operation by cancelling all pending scan @@ -458,11 +461,18 @@ static void mwifiex_free_lock_list(struct mwifiex_adapter *adapter) static void mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter) { + int i; + if (!adapter) { pr_err("%s: adapter is NULL\n", __func__); return; } + for (i = 0; i < adapter->priv_num; i++) { + if (adapter->priv[i]) + del_timer_sync(&adapter->priv[i]->scan_delay_timer); + } + mwifiex_cancel_all_pending_cmd(adapter); /* Free lock variables */ |
