• Johannes Berg's avatar
    iwlwifi: fix double free/complete in firmware loading · f69a23b7
    Johannes Berg authored
    Linus reported that due to mac80211 failing to register
    the device (due to WoWLAN) his machine crashed etc. as
    we double-freed the vmalloc() firmware area. His patch
    to fix it was very similar to this one but I noticed
    that there's another bug in the area: we complete the
    completion before starting, so since we're running in
    a work struct context stop() could be called while in
    the middle of start() which will almost certainly lead
    to issues.
    
    Make a modification similar to his to avoid the double-
    free but also move the completion to another spot so it
    is only done after start() either finished or failed so
    that stop() can have a consistent state.
    Reported-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
    Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
    f69a23b7
iwl-drv.c 30.1 KB