From: Zhu Yi Date: Mon, 15 Jun 2009 19:59:48 +0000 (+0200) Subject: iwmc3200wifi: fix potential kernel oops on module removal X-Git-Url: http://git.cdn.openwrt.org/?a=commitdiff_plain;h=4e9aa52e36a7beb4c0163324a3de759d7cf2e442;p=openwrt%2Fstaging%2Fblogic.git iwmc3200wifi: fix potential kernel oops on module removal The iwm_if_free() is called before destroy_workqueue for isr_wq on device remove method. But if there is still some pending work in the isr_wq, the required data structures are already freed at this point. This leeds a kernel oops. The patch fixes this problem by moving iwm_if_free after destroy_workqueue. Signed-off-by: Zhu Yi Signed-off-by: Samuel Ortiz Signed-off-by: John W. Linville --- diff --git a/drivers/net/wireless/iwmc3200wifi/sdio.c b/drivers/net/wireless/iwmc3200wifi/sdio.c index c0405715647a..916681837fd2 100644 --- a/drivers/net/wireless/iwmc3200wifi/sdio.c +++ b/drivers/net/wireless/iwmc3200wifi/sdio.c @@ -479,10 +479,10 @@ static void iwm_sdio_remove(struct sdio_func *func) struct iwm_priv *iwm = hw_to_iwm(hw); struct device *dev = &func->dev; - iwm_debugfs_exit(iwm); iwm_if_remove(iwm); - iwm_if_free(iwm); destroy_workqueue(hw->isr_wq); + iwm_debugfs_exit(iwm); + iwm_if_free(iwm); sdio_set_drvdata(func, NULL);