diff options
| author | Pavel Emelyanov <xemul@openvz.org> | 2008-05-04 17:59:30 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-05-04 17:59:30 -0700 |
| commit | 339a7c41c913035bf58579f6e47b4ba29da83795 (patch) | |
| tree | ef9c696d9d73f34f75c3470c0a1997964b2256eb /net/mac80211 | |
| parent | e340a90e6e07bba6e6b3fc39dd5fa76f95579d7c (diff) | |
| download | talos-op-linux-339a7c41c913035bf58579f6e47b4ba29da83795.tar.gz talos-op-linux-339a7c41c913035bf58579f6e47b4ba29da83795.zip | |
mac80211: Do not free net device after it is unregistered.
The error path in ieee80211_register_hw() may call the unregister_netdev()
and right after it - the free_netdev(), which is wrong, since the
unregister releases the device itself.
So the proposed fix is to NULL the local->mdev after unregister is done
and check this before calling free_netdev().
I checked - no code uses the local->mdev after unregister in this error
path (but even if some did this would be a BUG).
Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/mac80211')
| -rw-r--r-- | net/mac80211/main.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/net/mac80211/main.c b/net/mac80211/main.c index 9ad4e3631b6b..915afadb0602 100644 --- a/net/mac80211/main.c +++ b/net/mac80211/main.c @@ -1766,6 +1766,7 @@ fail_wep: fail_rate: ieee80211_debugfs_remove_netdev(IEEE80211_DEV_TO_SUB_IF(local->mdev)); unregister_netdevice(local->mdev); + local->mdev = NULL; fail_dev: rtnl_unlock(); sta_info_stop(local); @@ -1773,8 +1774,10 @@ fail_sta_info: debugfs_hw_del(local); destroy_workqueue(local->hw.workqueue); fail_workqueue: - ieee80211_if_free(local->mdev); - local->mdev = NULL; + if (local->mdev != NULL) { + ieee80211_if_free(local->mdev); + local->mdev = NULL; + } fail_mdev_alloc: wiphy_unregister(local->hw.wiphy); return result; |
