提交 4c1bcdb5 编写于 作者: G Grazvydas Ignotas 提交者: John W. Linville

wl1251: fix crash on remove due to leftover work item

This driver currently leaves elp_work behind when stopping, which
occasionally results in data corruption because work function ends
up accessing freed memory, typical symptoms of this are various
worker_thread crashes. Fix it by cancelling elp_work.

Cc: stable@vger.kernel.org # v2.6.37+
Signed-off-by: NGrazvydas Ignotas <notasas@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
上级 328c32f0
...@@ -479,6 +479,7 @@ static void wl1251_op_stop(struct ieee80211_hw *hw) ...@@ -479,6 +479,7 @@ static void wl1251_op_stop(struct ieee80211_hw *hw)
cancel_work_sync(&wl->irq_work); cancel_work_sync(&wl->irq_work);
cancel_work_sync(&wl->tx_work); cancel_work_sync(&wl->tx_work);
cancel_work_sync(&wl->filter_work); cancel_work_sync(&wl->filter_work);
cancel_delayed_work_sync(&wl->elp_work);
mutex_lock(&wl->mutex); mutex_lock(&wl->mutex);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册