Return-path: Received: from mail-pf0-f193.google.com ([209.85.192.193]:36044 "EHLO mail-pf0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755691AbcKJL56 (ORCPT ); Thu, 10 Nov 2016 06:57:58 -0500 Received: by mail-pf0-f193.google.com with SMTP id n85so3971779pfi.3 for ; Thu, 10 Nov 2016 03:57:57 -0800 (PST) From: Xinming Hu To: Linux Wireless Cc: Kalle Valo , Brian Norris , Dmitry Torokhov , Amitkumar Karwar , Cathy Luo , Xinming Hu , Brian Norris Subject: [PATCH RESEND v2 07/11] mwifiex: reset card->adapter during device unregister Date: Thu, 10 Nov 2016 19:57:08 +0800 Message-Id: <1478779032-5165-7-git-send-email-huxinming820@marvell.com> (sfid-20161110_125816_983723_9ED36110) In-Reply-To: <1478779032-5165-1-git-send-email-huxinming820@marvell.com> References: <1478779032-5165-1-git-send-email-huxinming820@marvell.com> Sender: linux-wireless-owner@vger.kernel.org List-ID: From: Xinming Hu card->adapter gets initialized in mwifiex_register_dev(). As it's not cleared in mwifiex_unregister_dev(), we may end up accessing the memory which is already free in below scenario. Scenario: Driver initialization is failed due to incorrect firmware or some other reason. Meanwhile device reboot/unload occurs. This is safe, now that we've properly synchronized suspend() and remove() with the FW initialization thread; now that code can simply check for 'card->adapter == NULL' and exit safely. Signed-off-by: Xinming Hu Signed-off-by: Amitkumar Karwar Signed-off-by: Brian Norris --- v2: Same as v1 --- drivers/net/wireless/marvell/mwifiex/pcie.c | 1 + drivers/net/wireless/marvell/mwifiex/sdio.c | 1 + 2 files changed, 2 insertions(+) diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c index 4d96683..1ab366c 100644 --- a/drivers/net/wireless/marvell/mwifiex/pcie.c +++ b/drivers/net/wireless/marvell/mwifiex/pcie.c @@ -3048,6 +3048,7 @@ static void mwifiex_unregister_dev(struct mwifiex_adapter *adapter) if (card->msi_enable) pci_disable_msi(pdev); } + card->adapter = NULL; } } diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c index 39ffe7d..4c4b012 100644 --- a/drivers/net/wireless/marvell/mwifiex/sdio.c +++ b/drivers/net/wireless/marvell/mwifiex/sdio.c @@ -2019,6 +2019,7 @@ static int mwifiex_alloc_sdio_mpa_buffers(struct mwifiex_adapter *adapter, struct sdio_mmc_card *card = adapter->card; if (adapter->card) { + card->adapter = NULL; sdio_claim_host(card->func); sdio_disable_func(card->func); sdio_release_host(card->func); -- 1.8.1.4