Return-path: Received: from mail-pf0-f196.google.com ([209.85.192.196]:34859 "EHLO mail-pf0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1761947AbcJaICy (ORCPT ); Mon, 31 Oct 2016 04:02:54 -0400 Received: by mail-pf0-f196.google.com with SMTP id s8so8097691pfj.2 for ; Mon, 31 Oct 2016 01:02:54 -0700 (PDT) From: Xinming Hu To: Linux Wireless Cc: Kalle Valo , Brian Norris , Dmitry Torokhov , Amitkumar Karwar , Cathy Luo , Xinming Hu , Brian Norris Subject: [PATCH 08/12] mwifiex: reset card->adapter during device unregister Date: Mon, 31 Oct 2016 16:02:16 +0800 Message-Id: <1477900940-10549-8-git-send-email-huxinming820@marvell.com> (sfid-20161031_090303_955132_6A95E12A) In-Reply-To: <1477900940-10549-1-git-send-email-huxinming820@marvell.com> References: <1477900940-10549-1-git-send-email-huxinming820@marvell.com> Sender: linux-wireless-owner@vger.kernel.org List-ID: From: Xinming Hu card->adapter gets initialized in mwifiex_register_dev(). As it's not cleared in mwifiex_unregister_dev(), we may end up accessing the memory which is already free in below scenario. Scenario: Driver initialization is failed due to incorrect firmware or some other reason. Meanwhile device reboot/unload occurs. This is safe, now that we've properly synchronized suspend() and remove() with the FW initialization thread; now that code can simply check for 'card->adapter == NULL' and exit safely. Signed-off-by: Xinming Hu Signed-off-by: Amitkumar Karwar Signed-off-by: Brian Norris --- drivers/net/wireless/marvell/mwifiex/pcie.c | 1 + drivers/net/wireless/marvell/mwifiex/sdio.c | 1 + 2 files changed, 2 insertions(+) diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c index b635563..04b9961 100644 --- a/drivers/net/wireless/marvell/mwifiex/pcie.c +++ b/drivers/net/wireless/marvell/mwifiex/pcie.c @@ -3017,6 +3017,7 @@ static void mwifiex_unregister_dev(struct mwifiex_adapter *adapter) if (card->msi_enable) pci_disable_msi(pdev); } + card->adapter = NULL; } } diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c index 4d314c1..375d0a5 100644 --- a/drivers/net/wireless/marvell/mwifiex/sdio.c +++ b/drivers/net/wireless/marvell/mwifiex/sdio.c @@ -2070,6 +2070,7 @@ mwifiex_unregister_dev(struct mwifiex_adapter *adapter) struct sdio_mmc_card *card = adapter->card; if (adapter->card) { + card->adapter = NULL; sdio_claim_host(card->func); sdio_disable_func(card->func); sdio_release_host(card->func); -- 1.8.1.4