mirror of https://github.com/torvalds/linux.git
1801a94299
If the restart work happens to run after the opmode left
(i.e. called iwl_trans_op_mode_leave), then the opmode memory (including
its mutex) is likely to be freed already, and trans->opmode is NULL.
Although the hw is stopped in that stage, which means that this restart
got aborted (i.e. STATUS_RESET_PENDING will be cleared),
it still can access trans->opmode (NULL pointer dereference)
or the opmodes memory (which is freed).
Fix this by canceling the restart wk in iwl_trans_op_mode_leave.
Also make sure that the restart wk is really aborted.
Fixes:
|
||
|---|---|---|
| .. | ||
| admtek | ||
| ath | ||
| atmel | ||
| broadcom | ||
| intel | ||
| intersil | ||
| marvell | ||
| mediatek | ||
| microchip | ||
| purelifi | ||
| quantenna | ||
| ralink | ||
| realtek | ||
| rsi | ||
| silabs | ||
| st | ||
| ti | ||
| virtual | ||
| zydas | ||
| Kconfig | ||
| Makefile | ||