| Message ID | 1347503608-3521-1-git-send-email-ming.lei@canonical.com (mailing list archive) |
|---|---|
| State | Not Applicable, archived |
| Headers | show |
On Thu, Sep 13, 2012 at 10:33 AM, Ming Lei <ming.lei@canonical.com> wrote: > Inside ath9k_hif_usb_firmware_fail(), the instance of > 'struct struct hif_device_usb' may be freed by > ath9k_hif_usb_disconnect() after > > complete(&hif_dev->fw_done); > > But 'hif_dev' is still accessed after the line code > above is executed. > > This patch fixes the issue by not accessing 'hif_dev' > after 'complete(&hif_dev->fw_done)' inside > ath9k_hif_usb_firmware_fail(). > > Cc: ath9k-devel@lists.ath9k.org > Cc: "Luis R. Rodriguez" <mcgrof@qca.qualcomm.com> > Cc: Jouni Malinen <jouni@qca.qualcomm.com> > Cc: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com> > Cc: Senthil Balasubramanian <senthilb@qca.qualcomm.com> > Cc: "John W. Linville" <linville@tuxdriver.com> Gentle ping, :-) Thanks, -- Ming Lei -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Thu, Sep 27, 2012 at 12:06:17PM +0800, Ming Lei wrote: > On Thu, Sep 13, 2012 at 10:33 AM, Ming Lei <ming.lei@canonical.com> wrote: > > Inside ath9k_hif_usb_firmware_fail(), the instance of > > 'struct struct hif_device_usb' may be freed by > > ath9k_hif_usb_disconnect() after > > > > complete(&hif_dev->fw_done); > > > > But 'hif_dev' is still accessed after the line code > > above is executed. > > > > This patch fixes the issue by not accessing 'hif_dev' > > after 'complete(&hif_dev->fw_done)' inside > > ath9k_hif_usb_firmware_fail(). > > > > Cc: ath9k-devel@lists.ath9k.org > > Cc: "Luis R. Rodriguez" <mcgrof@qca.qualcomm.com> > > Cc: Jouni Malinen <jouni@qca.qualcomm.com> > > Cc: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com> > > Cc: Senthil Balasubramanian <senthilb@qca.qualcomm.com> > > Cc: "John W. Linville" <linville@tuxdriver.com> > > Gentle ping, :-) This is commit e962610f8100e1b52973f5a9c855cbc3d1ba04ec in wireless-next?
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c index ee6e50a..924c461 100644 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c @@ -1072,14 +1072,15 @@ static void ath9k_hif_usb_dev_deinit(struct hif_device_usb *hif_dev) */ static void ath9k_hif_usb_firmware_fail(struct hif_device_usb *hif_dev) { - struct device *parent = hif_dev->udev->dev.parent; + struct device *dev = &hif_dev->udev->dev; + struct device *parent = dev->parent; complete(&hif_dev->fw_done); if (parent) device_lock(parent); - device_release_driver(&hif_dev->udev->dev); + device_release_driver(dev); if (parent) device_unlock(parent);
Inside ath9k_hif_usb_firmware_fail(), the instance of 'struct struct hif_device_usb' may be freed by ath9k_hif_usb_disconnect() after complete(&hif_dev->fw_done); But 'hif_dev' is still accessed after the line code above is executed. This patch fixes the issue by not accessing 'hif_dev' after 'complete(&hif_dev->fw_done)' inside ath9k_hif_usb_firmware_fail(). Cc: ath9k-devel@lists.ath9k.org Cc: "Luis R. Rodriguez" <mcgrof@qca.qualcomm.com> Cc: Jouni Malinen <jouni@qca.qualcomm.com> Cc: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com> Cc: Senthil Balasubramanian <senthilb@qca.qualcomm.com> Cc: "John W. Linville" <linville@tuxdriver.com> Signed-off-by: Ming Lei <ming.lei@canonical.com> --- drivers/net/wireless/ath/ath9k/hif_usb.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)