From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from mx0a-0016f401.pphosted.com ([67.231.148.174]:45886 "EHLO mx0b-0016f401.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1756661AbcKKNLf (ORCPT ); Fri, 11 Nov 2016 08:11:35 -0500 From: Amitkumar Karwar To: CC: Cathy Luo , Nishant Sarmukadam , , , , Xinming Hu , Amitkumar Karwar , Brian Norris Subject: [PATCH v3 07/11] mwifiex: reset card->adapter during device unregister Date: Fri, 11 Nov 2016 18:40:14 +0530 Message-ID: <1478869818-4340-7-git-send-email-akarwar@marvell.com> (sfid-20161111_141151_127019_0480B853) In-Reply-To: <1478869818-4340-1-git-send-email-akarwar@marvell.com> References: <1478869818-4340-1-git-send-email-akarwar@marvell.com> MIME-Version: 1.0 Content-Type: text/plain Sender: linux-wireless-owner@vger.kernel.org List-ID: From: Xinming Hu card->adapter gets initialized in mwifiex_register_dev(). As it's not cleared in mwifiex_unregister_dev(), we may end up accessing the memory which is already free in below scenario. Scenario: Driver initialization is failed due to incorrect firmware or some other reason. Meanwhile device reboot/unload occurs. This is safe, now that we've properly synchronized suspend() and remove() with the FW initialization thread; now that code can simply check for 'card->adapter == NULL' and exit safely. Signed-off-by: Xinming Hu Tested-by: Xinming Hu Signed-off-by: Amitkumar Karwar Signed-off-by: Brian Norris --- v3: Same as v1 and v2 --- drivers/net/wireless/marvell/mwifiex/pcie.c | 1 + drivers/net/wireless/marvell/mwifiex/sdio.c | 1 + 2 files changed, 2 insertions(+) diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c index 4d96683..1ab366c 100644 --- a/drivers/net/wireless/marvell/mwifiex/pcie.c +++ b/drivers/net/wireless/marvell/mwifiex/pcie.c @@ -3048,6 +3048,7 @@ static void mwifiex_unregister_dev(struct mwifiex_adapter *adapter) if (card->msi_enable) pci_disable_msi(pdev); } + card->adapter = NULL; } } diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c index 39ffe7d..4c4b012 100644 --- a/drivers/net/wireless/marvell/mwifiex/sdio.c +++ b/drivers/net/wireless/marvell/mwifiex/sdio.c @@ -2019,6 +2019,7 @@ static int mwifiex_alloc_sdio_mpa_buffers(struct mwifiex_adapter *adapter, struct sdio_mmc_card *card = adapter->card; if (adapter->card) { + card->adapter = NULL; sdio_claim_host(card->func); sdio_disable_func(card->func); sdio_release_host(card->func); -- 1.9.1