b43: Don't abuse wl->current_dev in the led work

Don't abuse wl->current_dev in the LED work for checking whether we're
going down. Add an explicit variable.
This fixes a crash on rmmod dereferencing the wl->current_dev NULL pointer
in various other places of the driver.

Signed-off-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/drivers/net/wireless/b43/leds.c b/drivers/net/wireless/b43/leds.c
index ac5a322c84b7ff8f397c59cb1c80f3c057c0bb52..fbe31e02688b52af763e4c108277bd4fbd1cac85 100644 (file)
--- a/drivers/net/wireless/b43/leds.c
+++ b/drivers/net/wireless/b43/leds.c
@@ -112,10 +112,7 @@ static void b43_led_brightness_set(struct led_classdev *led_dev,
        struct b43_led *led = container_of(led_dev, struct b43_led, led_dev);
        struct b43_wl *wl = led->wl;
 
-       /* The check for current_dev is only needed while unregistering,
-        * so it is sequencial and does not race. But we must not dereference
-        * current_dev here. */
-       if (likely(wl->current_dev)) {
+       if (likely(!wl->leds.stop)) {
                atomic_set(&led->state, brightness);
                ieee80211_queue_work(wl->hw, &wl->leds.work);
        }
@@ -314,6 +311,8 @@ void b43_leds_init(struct b43_wldev *dev)
                        break;
                }
        }
+
+       dev->wl->leds.stop = 0;
 }
 
 void b43_leds_exit(struct b43_wldev *dev)

diff --git a/drivers/net/wireless/b43/leds.h b/drivers/net/wireless/b43/leds.h
index c4a58a0fc1d563648dc0ede780613ab2db83f73b..49d3da540c285fd08925f265e539838bd69fa6c6 100644 (file)
--- a/drivers/net/wireless/b43/leds.h
+++ b/drivers/net/wireless/b43/leds.h
@@ -35,6 +35,7 @@ struct b43_leds {
        struct b43_led led_radio;
        struct b43_led led_assoc;
 
+       bool stop;
        struct work_struct work;
 };
 

diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 7fa947ca7c32df8151e202e24d7e47eecb437de2..a8840ef63770f9e8c7d9abbdeb9ed8d20cecdfc9 100644 (file)
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -4987,7 +4987,7 @@ static void b43_remove(struct ssb_device *dev)
                 * might have modified it. Restoring is important, so the networking
                 * stack can properly free resources. */
                wl->hw->queues = wl->mac80211_initially_registered_queues;
-               wl->current_dev = NULL;
+               wl->leds.stop = 1;
                cancel_work_sync(&wl->leds.work);
                ieee80211_unregister_hw(wl->hw);
        }