diff options
| author | Sven Neumann <s.neumann@raumfeld.com> | 2010-11-24 19:02:00 +0300 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2010-11-29 22:41:27 +0300 |
| commit | 16ccdf0dbc84b11bc8b7fdbad66804d06a683554 (patch) | |
| tree | 26911c901e58af22b94c4e0b6539ada0f8194589 /drivers/net/wireless/libertas/if_sdio.c | |
| parent | 517ff43146b17a0d067125f098f675d1e0ac2d82 (diff) | |
| download | linux-16ccdf0dbc84b11bc8b7fdbad66804d06a683554.tar.xz | |
libertas: fix invalid access
card->priv must not be accessed after lbs_remove_card() was called
as lbs_remove_card() frees card->priv via free_netdev().
For libertas_sdio this is a regression introduced by 23b149c1890f9.
The correct fix to the issue described there is simply to remove the
assignment. This flag is set at the appropriate time inside
lbs_remove_card anyway.
Reported-by: Daniel Drake <dsd@laptop.org>
Signed-off-by: Sven Neumann <s.neumann@raumfeld.com>
Signed-off-by: Daniel Drake <dsd@laptop.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/libertas/if_sdio.c')
| -rw-r--r-- | drivers/net/wireless/libertas/if_sdio.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c index e5685dc317a8..b4de0ca10feb 100644 --- a/drivers/net/wireless/libertas/if_sdio.c +++ b/drivers/net/wireless/libertas/if_sdio.c @@ -1170,7 +1170,6 @@ static void if_sdio_remove(struct sdio_func *func) lbs_deb_sdio("call remove card\n"); lbs_stop_card(card->priv); lbs_remove_card(card->priv); - card->priv->surpriseremoved = 1; flush_workqueue(card->workqueue); destroy_workqueue(card->workqueue); |