iwmc3200wifi: fix potential kernel oops on module removal
The iwm_if_free() is called before destroy_workqueue for isr_wq on device remove method. But if there is still some pending work in the isr_wq, the required data structures are already freed at this point. This leeds a kernel oops. The patch fixes this problem by moving iwm_if_free after destroy_workqueue. Signed-off-by: Zhu Yi <yi.zhu@intel.com> Signed-off-by: Samuel Ortiz <samuel.ortiz@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
parent
d7e057dca3
commit
4e9aa52e36
|
@ -479,10 +479,10 @@ static void iwm_sdio_remove(struct sdio_func *func)
|
|||
struct iwm_priv *iwm = hw_to_iwm(hw);
|
||||
struct device *dev = &func->dev;
|
||||
|
||||
iwm_debugfs_exit(iwm);
|
||||
iwm_if_remove(iwm);
|
||||
iwm_if_free(iwm);
|
||||
destroy_workqueue(hw->isr_wq);
|
||||
iwm_debugfs_exit(iwm);
|
||||
iwm_if_free(iwm);
|
||||
|
||||
sdio_set_drvdata(func, NULL);
|
||||
|
||||
|
|
Loading…
Reference in a new issue