summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorPavel Emelyanov <xemul@openvz.org>2008-05-04 17:59:30 -0700
committerDavid S. Miller <davem@davemloft.net>2008-05-04 17:59:30 -0700
commit339a7c41c913035bf58579f6e47b4ba29da83795 (patch)
treeef9c696d9d73f34f75c3470c0a1997964b2256eb /net
parente340a90e6e07bba6e6b3fc39dd5fa76f95579d7c (diff)
downloadlinux-next-339a7c41c913035bf58579f6e47b4ba29da83795.tar.gz
mac80211: Do not free net device after it is unregistered.
The error path in ieee80211_register_hw() may call the unregister_netdev() and right after it - the free_netdev(), which is wrong, since the unregister releases the device itself. So the proposed fix is to NULL the local->mdev after unregister is done and check this before calling free_netdev(). I checked - no code uses the local->mdev after unregister in this error path (but even if some did this would be a BUG). Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/mac80211/main.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 9ad4e3631b6b..915afadb0602 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -1766,6 +1766,7 @@ fail_wep:
fail_rate:
ieee80211_debugfs_remove_netdev(IEEE80211_DEV_TO_SUB_IF(local->mdev));
unregister_netdevice(local->mdev);
+ local->mdev = NULL;
fail_dev:
rtnl_unlock();
sta_info_stop(local);
@@ -1773,8 +1774,10 @@ fail_sta_info:
debugfs_hw_del(local);
destroy_workqueue(local->hw.workqueue);
fail_workqueue:
- ieee80211_if_free(local->mdev);
- local->mdev = NULL;
+ if (local->mdev != NULL) {
+ ieee80211_if_free(local->mdev);
+ local->mdev = NULL;
+ }
fail_mdev_alloc:
wiphy_unregister(local->hw.wiphy);
return result;