dpc_tl_lock is not acquired in the error handle code for bus down.
But it's unlocked using spin_unlock_irqrestore after finishing task
list walk down. Grab the lock before breaking the loop to avoid a
double unlock.
Reported-by: Dan Carpenter <[email protected]>
Signed-off-by: Franky Lin <[email protected]>
---
drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index eb3829b..e2b34e1 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -2637,6 +2637,7 @@ static int brcmf_sdbrcm_dpc_thread(void *data)
/* after stopping the bus, exit thread */
brcmf_sdbrcm_bus_stop(bus->sdiodev->dev);
bus->dpc_tsk = NULL;
+ spin_lock_irqsave(&bus->dpc_tl_lock, flags);
break;
}
--
1.7.9.5