[PATCH stable] b43: Fix controller restart crash

[Michael Buesch <mb@bu3sch.de>]

This fixes a kernel crash on rmmod, in the case where the controller
was restarted before doing the rmmod.

Upstream commit is 4735f5022c97f6624ced2ec5056c61c4b437d53b

Signed-off-by: Michael Buesch <mb@bu3sch.de>

---

Index: linux-2.6.25.4/drivers/net/wireless/b43/main.c
===================================================================
--- linux-2.6.25.4.orig/drivers/net/wireless/b43/main.c	2008-06-06 15:36:38.000000000 +0200
+++ linux-2.6.25.4/drivers/net/wireless/b43/main.c	2008-06-06 15:36:40.000000000 +0200
@@ -3815,13 +3815,15 @@ static void b43_chip_reset(struct work_s
 		err = b43_wireless_core_start(dev);
 		if (err) {
 			b43_wireless_core_exit(dev);
 			goto out;
 		}
 	}
-      out:
+out:
+	if (err)
+		wl->current_dev = NULL; /* Failed to init the dev. */
 	mutex_unlock(&wl->mutex);
 	if (err)
 		b43err(wl, "Controller restart FAILED\n");
 	else
 		b43info(wl, "Controller restarted\n");
 }
@@ -3964,15 +3966,17 @@ err_powerdown:
 
 static void b43_one_core_detach(struct ssb_device *dev)
 {
 	struct b43_wldev *wldev;
 	struct b43_wl *wl;
 
+	/* Do not cancel ieee80211-workqueue based work here.
+	 * See comment in b43_remove(). */
+
 	wldev = ssb_get_drvdata(dev);
 	wl = wldev->wl;
-	cancel_work_sync(&wldev->restart_work);
 	b43_debugfs_remove_device(wldev);
 	b43_wireless_core_detach(wldev);
 	list_del(&wldev->list);
 	wl->nr_devs--;
 	ssb_set_drvdata(dev, NULL);
 	kfree(wldev);
@@ -4149,12 +4153,16 @@ static int b43_probe(struct ssb_device *
 
 static void b43_remove(struct ssb_device *dev)
 {
 	struct b43_wl *wl = ssb_get_devtypedata(dev);
 	struct b43_wldev *wldev = ssb_get_drvdata(dev);
 
+	/* We must cancel any work here before unregistering from ieee80211,
+	 * as the ieee80211 unreg will destroy the workqueue. */
+	cancel_work_sync(&wldev->restart_work);
+
 	B43_WARN_ON(!wl);
 	if (wl->current_dev == wldev)
 		ieee80211_unregister_hw(wl->hw);
 
 	b43_one_core_detach(dev);