Inside ath9k_hif_usb_firmware_fail(), the instance of
'struct struct hif_device_usb' may be freed by
ath9k_hif_usb_disconnect() after
complete(&hif_dev->fw_done);
But 'hif_dev' is still accessed after the line code
above is executed.
This patch fixes the issue by not accessing 'hif_dev'
after 'complete(&hif_dev->fw_done)' inside
ath9k_hif_usb_firmware_fail().
Cc: ath9k-devel@lists.ath9k.org
Cc: "Luis R. Rodriguez" <mcg...@qca.qualcomm.com>
Cc: Jouni Malinen <jo...@qca.qualcomm.com>
Cc: Vasanthakumar Thiagarajan <vthia...@qca.qualcomm.com>
Cc: Senthil Balasubramanian <senth...@qca.qualcomm.com>
Cc: "John W. Linville" <linvi...@tuxdriver.com>
Signed-off-by: Ming Lei <ming....@canonical.com>
---
drivers/net/wireless/ath/ath9k/hif_usb.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c
b/drivers/net/wireless/ath/ath9k/hif_usb.c
index ee6e50a..924c461 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -1072,14 +1072,15 @@ static void ath9k_hif_usb_dev_deinit(struct
hif_device_usb *hif_dev)
*/
static void ath9k_hif_usb_firmware_fail(struct hif_device_usb *hif_dev)
{
- struct device *parent = hif_dev->udev->dev.parent;
+ struct device *dev = &hif_dev->udev->dev;
+ struct device *parent = dev->parent;
complete(&hif_dev->fw_done);
if (parent)
device_lock(parent);
- device_release_driver(&hif_dev->udev->dev);
+ device_release_driver(dev);
if (parent)
device_unlock(parent);
--
1.7.9.5
_______________________________________________
ath9k-devel mailing list
ath9k-devel@lists.ath9k.org
https://lists.ath9k.org/mailman/listinfo/ath9k-devel
