| From 95621ff6766a8aaa031871d0629b71f5a8c69a8b Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 1 Jun 2021 18:01:28 +0800 |
| Subject: brcmfmac: Fix a double-free in brcmf_sdio_bus_reset |
| |
| From: Tong Tiangen <tongtiangen@huawei.com> |
| |
| [ Upstream commit 7ea7a1e05c7ff5ffc9f9ec1f0849f6ceb7fcd57c ] |
| |
| brcmf_sdiod_remove has been called inside brcmf_sdiod_probe when fails, |
| so there's no need to call another one. Otherwise, sdiodev->freezer |
| would be double freed. |
| |
| Fixes: 7836102a750a ("brcmfmac: reset SDIO bus on a firmware crash") |
| Signed-off-by: Tong Tiangen <tongtiangen@huawei.com> |
| Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com> |
| Signed-off-by: Kalle Valo <kvalo@codeaurora.org> |
| Link: https://lore.kernel.org/r/20210601100128.69561-1-tongtiangen@huawei.com |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 1 - |
| 1 file changed, 1 deletion(-) |
| |
| diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c |
| index 59c2b2b6027d..6d5d5c39c635 100644 |
| --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c |
| +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c |
| @@ -4157,7 +4157,6 @@ static int brcmf_sdio_bus_reset(struct device *dev) |
| if (ret) { |
| brcmf_err("Failed to probe after sdio device reset: ret %d\n", |
| ret); |
| - brcmf_sdiod_remove(sdiodev); |
| } |
| |
| return ret; |
| -- |
| 2.30.2 |
| |
