| From 4c1bcdb5a3354b250b82a67549f57ac27a3bb85f Mon Sep 17 00:00:00 2001 |
| From: Grazvydas Ignotas <notasas@gmail.com> |
| Date: Thu, 26 Apr 2012 23:07:44 +0300 |
| Subject: wl1251: fix crash on remove due to leftover work item |
| |
| From: Grazvydas Ignotas <notasas@gmail.com> |
| |
| commit 4c1bcdb5a3354b250b82a67549f57ac27a3bb85f upstream. |
| |
| This driver currently leaves elp_work behind when stopping, which |
| occasionally results in data corruption because work function ends |
| up accessing freed memory, typical symptoms of this are various |
| worker_thread crashes. Fix it by cancelling elp_work. |
| |
| Signed-off-by: Grazvydas Ignotas <notasas@gmail.com> |
| Signed-off-by: John W. Linville <linville@tuxdriver.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/net/wireless/wl1251/main.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| --- a/drivers/net/wireless/wl1251/main.c |
| +++ b/drivers/net/wireless/wl1251/main.c |
| @@ -479,6 +479,7 @@ static void wl1251_op_stop(struct ieee80 |
| cancel_work_sync(&wl->irq_work); |
| cancel_work_sync(&wl->tx_work); |
| cancel_work_sync(&wl->filter_work); |
| + cancel_delayed_work_sync(&wl->elp_work); |
| |
| mutex_lock(&wl->mutex); |
| |
