diff options
| author | Zhu Yi <yi.zhu@intel.com> | 2009-06-15 21:59:48 +0200 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2009-06-19 11:50:16 -0400 |
| commit | 4e9aa52e36a7beb4c0163324a3de759d7cf2e442 (patch) | |
| tree | c8dd577dd48b8ab7402557e1b2ecdfac2ef8d002 /drivers/net/wireless/iwmc3200wifi | |
| parent | d7e057dca3f1b76ff44dd16fefcd493a52614aad (diff) | |
iwmc3200wifi: fix potential kernel oops on module removal
The iwm_if_free() is called before destroy_workqueue for isr_wq on
device remove method. But if there is still some pending work in
the isr_wq, the required data structures are already freed at this
point. This leeds a kernel oops. The patch fixes this problem by
moving iwm_if_free after destroy_workqueue.
Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: Samuel Ortiz <samuel.ortiz@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/iwmc3200wifi')
| -rw-r--r-- | drivers/net/wireless/iwmc3200wifi/sdio.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/wireless/iwmc3200wifi/sdio.c b/drivers/net/wireless/iwmc3200wifi/sdio.c index c0405715647..916681837fd 100644 --- a/drivers/net/wireless/iwmc3200wifi/sdio.c +++ b/drivers/net/wireless/iwmc3200wifi/sdio.c @@ -479,10 +479,10 @@ static void iwm_sdio_remove(struct sdio_func *func) struct iwm_priv *iwm = hw_to_iwm(hw); struct device *dev = &func->dev; - iwm_debugfs_exit(iwm); iwm_if_remove(iwm); - iwm_if_free(iwm); destroy_workqueue(hw->isr_wq); + iwm_debugfs_exit(iwm); + iwm_if_free(iwm); sdio_set_drvdata(func, NULL); |