wl1251: fix crash on remove due to leftover work item
authorGrazvydas Ignotas <notasas@gmail.com>
Thu, 26 Apr 2012 20:07:44 +0000 (23:07 +0300)
committerJohn W. Linville <linville@tuxdriver.com>
Fri, 27 Apr 2012 19:25:25 +0000 (15:25 -0400)
This driver currently leaves elp_work behind when stopping, which
occasionally results in data corruption because work function ends
up accessing freed memory, typical symptoms of this are various
worker_thread crashes. Fix it by cancelling elp_work.

Cc: stable@vger.kernel.org # v2.6.37+
Signed-off-by: Grazvydas Ignotas <notasas@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/wl1251/main.c

index 41302c7..d1afb8e 100644 (file)
@@ -479,6 +479,7 @@ static void wl1251_op_stop(struct ieee80211_hw *hw)
        cancel_work_sync(&wl->irq_work);
        cancel_work_sync(&wl->tx_work);
        cancel_work_sync(&wl->filter_work);
+       cancel_delayed_work_sync(&wl->elp_work);
 
        mutex_lock(&wl->mutex);