wil6210: fix access after free in wil_pcie_remove()
authorVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Wed, 6 Aug 2014 07:32:01 +0000 (10:32 +0300)
committerJohn W. Linville <linville@tuxdriver.com>
Mon, 25 Aug 2014 20:17:38 +0000 (16:17 -0400)
'wil'  released in wil_if_free(); save iomapped address aside to
properly unmap it.

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/ath/wil6210/pcie_bus.c

index cf0b21987d7014b9a57bc0e49cd44dc75005eac9..38dcbea49d449a650ad79c810608bcc8785d1dbd 100644 (file)
@@ -218,12 +218,13 @@ static int wil_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 static void wil_pcie_remove(struct pci_dev *pdev)
 {
        struct wil6210_priv *wil = pci_get_drvdata(pdev);
+       void __iomem *csr = wil->csr;
 
        wil6210_debugfs_remove(wil);
        wil_if_pcie_disable(wil);
        wil_if_remove(wil);
        wil_if_free(wil);
-       pci_iounmap(pdev, wil->csr);
+       pci_iounmap(pdev, csr);
        pci_release_region(pdev, 0);
        pci_disable_device(pdev);
 }