aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/net/wireless/hostap/hostap_cs.c
diff options
context:
space:
mode:
authorJouni Malinen <jkmaline@cc.hut.fi>2005-10-02 20:19:00 -0400
committerJeff Garzik <jgarzik@pobox.com>2005-10-03 22:00:08 -0400
commitc355184cd3cd58c9ffc78f2a17e0ac3563312ea7 (patch)
treef6de150b08f98540bf660cedffd77785ce75b479 /drivers/net/wireless/hostap/hostap_cs.c
parentf7a74447553d698795ba74b7e17e916000b0cb08 (diff)
[PATCH] hostap: Do not free local->hw_priv before unregistering netdev
local->hw_priv was being freed and set to NULL just before calling prism2_free_local_data(). However, this may expose a race condition in which something ends up trying to use hw_priv during shutdown. I haven't noticed this happening, but better be safe than sorry, so let's postpone hw_priv freeing to happen only after prism2_free_local_data() has returned. Signed-off-by: Jouni Malinen <jkmaline@cc.hut.fi> Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
Diffstat (limited to 'drivers/net/wireless/hostap/hostap_cs.c')
-rw-r--r--drivers/net/wireless/hostap/hostap_cs.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/net/wireless/hostap/hostap_cs.c b/drivers/net/wireless/hostap/hostap_cs.c
index 23bcc51b7131..2643976a6677 100644
--- a/drivers/net/wireless/hostap/hostap_cs.c
+++ b/drivers/net/wireless/hostap/hostap_cs.c
@@ -565,13 +565,14 @@ static void prism2_detach(dev_link_t *link)
565 *linkp = link->next; 565 *linkp = link->next;
566 /* release net devices */ 566 /* release net devices */
567 if (link->priv) { 567 if (link->priv) {
568 struct hostap_cs_priv *hw_priv;
568 struct net_device *dev; 569 struct net_device *dev;
569 struct hostap_interface *iface; 570 struct hostap_interface *iface;
570 dev = link->priv; 571 dev = link->priv;
571 iface = netdev_priv(dev); 572 iface = netdev_priv(dev);
572 kfree(iface->local->hw_priv); 573 hw_priv = iface->local->hw_priv;
573 iface->local->hw_priv = NULL;
574 prism2_free_local_data(dev); 574 prism2_free_local_data(dev);
575 kfree(hw_priv);
575 } 576 }
576 kfree(link); 577 kfree(link);
577} 578}