From: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Date: Wed, 6 Aug 2014 07:32:01 +0000 (+0300)
Subject: wil6210: fix access after free in wil_pcie_remove()
X-Git-Tag: v4.14-rc1~6661^2~133^2~61
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=560ce3087292603dafb2603ee12cab0ff6c20aee;p=platform%2Fkernel%2Flinux-rpi.git

wil6210: fix access after free in wil_pcie_remove()

'wil'  released in wil_if_free(); save iomapped address aside to
properly unmap it.

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---

diff --git a/drivers/net/wireless/ath/wil6210/pcie_bus.c b/drivers/net/wireless/ath/wil6210/pcie_bus.c
index cf0b219..38dcbea 100644
--- a/drivers/net/wireless/ath/wil6210/pcie_bus.c
+++ b/drivers/net/wireless/ath/wil6210/pcie_bus.c
@@ -218,12 +218,13 @@ static int wil_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 static void wil_pcie_remove(struct pci_dev *pdev)
 {
 	struct wil6210_priv *wil = pci_get_drvdata(pdev);
+	void __iomem *csr = wil->csr;
 
 	wil6210_debugfs_remove(wil);
 	wil_if_pcie_disable(wil);
 	wil_if_remove(wil);
 	wil_if_free(wil);
-	pci_iounmap(pdev, wil->csr);
+	pci_iounmap(pdev, csr);
 	pci_release_region(pdev, 0);
 	pci_disable_device(pdev);
 }