Return-path: Received: from vs166246.vserver.de ([62.75.166.246]:34350 "EHLO vs166246.vserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757724AbYFFN7t (ORCPT ); Fri, 6 Jun 2008 09:59:49 -0400 From: Michael Buesch To: stable@kernel.org Subject: [PATCH stable] b43: Fix controller restart crash Date: Fri, 6 Jun 2008 15:58:42 +0200 Cc: linux-wireless@vger.kernel.org, bcm43xx-dev@lists.berlios.de MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Message-Id: <200806061558.42998.mb@bu3sch.de> (sfid-20080606_160016_238664_B88F1424) Sender: linux-wireless-owner@vger.kernel.org List-ID: This fixes a kernel crash on rmmod, in the case where the controller was restarted before doing the rmmod. Upstream commit is 4735f5022c97f6624ced2ec5056c61c4b437d53b Signed-off-by: Michael Buesch --- Index: linux-2.6.25.4/drivers/net/wireless/b43/main.c =================================================================== --- linux-2.6.25.4.orig/drivers/net/wireless/b43/main.c 2008-06-06 15:36:38.000000000 +0200 +++ linux-2.6.25.4/drivers/net/wireless/b43/main.c 2008-06-06 15:36:40.000000000 +0200 @@ -3815,13 +3815,15 @@ static void b43_chip_reset(struct work_s err = b43_wireless_core_start(dev); if (err) { b43_wireless_core_exit(dev); goto out; } } - out: +out: + if (err) + wl->current_dev = NULL; /* Failed to init the dev. */ mutex_unlock(&wl->mutex); if (err) b43err(wl, "Controller restart FAILED\n"); else b43info(wl, "Controller restarted\n"); } @@ -3964,15 +3966,17 @@ err_powerdown: static void b43_one_core_detach(struct ssb_device *dev) { struct b43_wldev *wldev; struct b43_wl *wl; + /* Do not cancel ieee80211-workqueue based work here. + * See comment in b43_remove(). */ + wldev = ssb_get_drvdata(dev); wl = wldev->wl; - cancel_work_sync(&wldev->restart_work); b43_debugfs_remove_device(wldev); b43_wireless_core_detach(wldev); list_del(&wldev->list); wl->nr_devs--; ssb_set_drvdata(dev, NULL); kfree(wldev); @@ -4149,12 +4153,16 @@ static int b43_probe(struct ssb_device * static void b43_remove(struct ssb_device *dev) { struct b43_wl *wl = ssb_get_devtypedata(dev); struct b43_wldev *wldev = ssb_get_drvdata(dev); + /* We must cancel any work here before unregistering from ieee80211, + * as the ieee80211 unreg will destroy the workqueue. */ + cancel_work_sync(&wldev->restart_work); + B43_WARN_ON(!wl); if (wl->current_dev == wldev) ieee80211_unregister_hw(wl->hw); b43_one_core_detach(dev);