Commit c81d034b authored by Arend Van Spriel's avatar Arend Van Spriel Committed by Greg Kroah-Hartman

brcmfmac: unbind all devices upon failure in firmware callback

commit 7a51461f upstream.

When request firmware fails, brcmf_ops_sdio_remove is being called and
brcmf_bus freed. In such circumstancies if you do a suspend/resume cycle
the kernel hangs on resume due a NULL pointer dereference in resume
function. So in brcmf_sdio_firmware_callback() we need to unbind the
driver from both sdio_func devices when firmware load failure is indicated.
Tested-by: default avatarEnric Balletbo i Serra <enric.balletbo@collabora.com>
Reviewed-by: default avatarHante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: default avatarPieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: default avatarFranky Lin <franky.lin@broadcom.com>
Signed-off-by: default avatarArend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ba2d8d67
...@@ -3985,14 +3985,14 @@ static void brcmf_sdio_firmware_callback(struct device *dev, int err, ...@@ -3985,14 +3985,14 @@ static void brcmf_sdio_firmware_callback(struct device *dev, int err,
u8 saveclk; u8 saveclk;
brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err); brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
bus_if = dev_get_drvdata(dev);
sdiodev = bus_if->bus_priv.sdio;
if (err) if (err)
goto fail; goto fail;
bus_if = dev_get_drvdata(dev);
if (!bus_if->drvr) if (!bus_if->drvr)
return; return;
sdiodev = bus_if->bus_priv.sdio;
bus = sdiodev->bus; bus = sdiodev->bus;
/* try to download image and nvram to the dongle */ /* try to download image and nvram to the dongle */
...@@ -4081,6 +4081,7 @@ static void brcmf_sdio_firmware_callback(struct device *dev, int err, ...@@ -4081,6 +4081,7 @@ static void brcmf_sdio_firmware_callback(struct device *dev, int err,
fail: fail:
brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err); brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err);
device_release_driver(dev); device_release_driver(dev);
device_release_driver(&sdiodev->func[2]->dev);
} }
struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev) struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment