lkml.org 
[lkml]   [2021]   [Jul]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.12 410/700] brcmfmac: Fix a double-free in brcmf_sdio_bus_reset
    Date
    From: Tong Tiangen <tongtiangen@huawei.com>

    [ Upstream commit 7ea7a1e05c7ff5ffc9f9ec1f0849f6ceb7fcd57c ]

    brcmf_sdiod_remove has been called inside brcmf_sdiod_probe when fails,
    so there's no need to call another one. Otherwise, sdiodev->freezer
    would be double freed.

    Fixes: 7836102a750a ("brcmfmac: reset SDIO bus on a firmware crash")
    Signed-off-by: Tong Tiangen <tongtiangen@huawei.com>
    Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Link: https://lore.kernel.org/r/20210601100128.69561-1-tongtiangen@huawei.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 1 -
    1 file changed, 1 deletion(-)

    diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
    index 16ed325795a8..3a1c98a046f0 100644
    --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
    +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
    @@ -4162,7 +4162,6 @@ static int brcmf_sdio_bus_reset(struct device *dev)
    if (ret) {
    brcmf_err("Failed to probe after sdio device reset: ret %d\n",
    ret);
    - brcmf_sdiod_remove(sdiodev);
    }

    return ret;
    --
    2.30.2


    \
     
     \ /
      Last update: 2021-07-12 10:09    [W:2.371 / U:0.240 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site