wl1271: Fix work cancelling when shutting down the driver

The work cancelling has had several hazards, ranging from potentially
executing work after the driver is in OFF state, to executing work after
the driver and relevant memory structures are already removed.

Fix these.

Signed-off-by: Juuso Oikarinen <juuso.oikarinen@nokia.com>
Reviewed-by: Teemu Paasikivi <ext-teemu.3.paasikivi@nokia.com>
Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com>

3 files changed, 9 insertions, 0 deletions

diff --git a/drivers/net/wireless/wl12xx/wl1271_event.c b/drivers/net/wireless/wl12xx/wl1271_event.c
index bced8296a251..e6c839af9038 100644
--- a/drivers/net/wireless/wl12xx/wl1271_event.c
+++ b/drivers/net/wireless/wl12xx/wl1271_event.c
@@ -41,6 +41,9 @@ void wl1271_pspoll_work(struct work_struct *work)
 
         mutex_lock(&wl->mutex);
 
+        if (unlikely(wl->state == WL1271_STATE_OFF))
+                goto out;
+
         if (!test_and_clear_bit(WL1271_FLAG_PSPOLL_FAILURE, &wl->flags))
                 goto out;
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_main.c b/drivers/net/wireless/wl12xx/wl1271_main.c
index 0026e775bb0d..9ab4fc4f7b4b 100644
--- a/drivers/net/wireless/wl12xx/wl1271_main.c
+++ b/drivers/net/wireless/wl12xx/wl1271_main.c
@@ -792,6 +792,8 @@ int wl1271_plt_stop(struct wl1271 *wl)
 out:
         mutex_unlock(&wl->mutex);
 
+        cancel_work_sync(&wl->irq_work);
+
         return ret;
 }
 
@@ -995,6 +997,7 @@ static void wl1271_op_remove_interface(struct ieee80211_hw *hw,
         cancel_work_sync(&wl->irq_work);
         cancel_work_sync(&wl->tx_work);
         cancel_delayed_work_sync(&wl->pspoll_work);
+        cancel_delayed_work_sync(&wl->elp_work);
 
         mutex_lock(&wl->mutex);
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_ps.c b/drivers/net/wireless/wl12xx/wl1271_ps.c
index f75668e413fd..150dc674d8b4 100644
--- a/drivers/net/wireless/wl12xx/wl1271_ps.c
+++ b/drivers/net/wireless/wl12xx/wl1271_ps.c
@@ -39,6 +39,9 @@ void wl1271_elp_work(struct work_struct *work)
 
         mutex_lock(&wl->mutex);
 
+        if (unlikely(wl->state == WL1271_STATE_OFF))
+                goto out;
+
         if (test_bit(WL1271_FLAG_IN_ELP, &wl->flags) ||
             (!test_bit(WL1271_FLAG_PSM, &wl->flags) &&
              !test_bit(WL1271_FLAG_IDLE, &wl->flags)))