[PATCH] hostap: Do not free local->hw_priv before unregistering netdev

local->hw_priv was being freed and set to NULL just before calling
prism2_free_local_data(). However, this may expose a race condition in
which something ends up trying to use hw_priv during shutdown. I
haven't noticed this happening, but better be safe than sorry, so
let's postpone hw_priv freeing to happen only after
prism2_free_local_data() has returned.

Signed-off-by: Jouni Malinen <jkmaline@cc.hut.fi>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

1 files changed, 2 insertions, 7 deletions

diff --git a/drivers/net/wireless/hostap/hostap_pci.c b/drivers/net/wireless/hostap/hostap_pci.c
index 0d7305dfa69..da0c80fb941 100644
--- a/drivers/net/wireless/hostap/hostap_pci.c
+++ b/drivers/net/wireless/hostap/hostap_pci.c
@@ -358,8 +358,6 @@ static int prism2_pci_probe(struct pci_dev *pdev,
         return hostap_hw_ready(dev);
 
  fail:
-        kfree(hw_priv);
-
         if (irq_registered && dev)
                 free_irq(dev->irq, dev);
 
@@ -370,10 +368,8 @@ static int prism2_pci_probe(struct pci_dev *pdev,
 
  err_out_disable:
         pci_disable_device(pdev);
-        kfree(hw_priv);
-        if (local)
-                local->hw_priv = NULL;
         prism2_free_local_data(dev);
+        kfree(hw_priv);
 
         return -ENODEV;
 }
@@ -398,9 +394,8 @@ static void prism2_pci_remove(struct pci_dev *pdev)
                 free_irq(dev->irq, dev);
 
         mem_start = hw_priv->mem_start;
-        kfree(hw_priv);
-        iface->local->hw_priv = NULL;
         prism2_free_local_data(dev);
+        kfree(hw_priv);
 
         iounmap(mem_start);