| Message ID | 1434401319-16136-2-git-send-email-arend@broadcom.com (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Kalle Valo |
| Headers | show |
> When freeing the driver ifp pointer it should also be removed from > the driver interface list, which is what brcmf_remove_interface() > does. Otherwise, the ifp pointer will be freed twice triggering > a kernel oops. > > Fixes: f37d69a4babc ("brcmfmac: free ifp for non-netdev interface in p2p module") > Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com> > Reviewed-by: Hante Meuleman <meuleman@broadcom.com> > Signed-off-by: Arend van Spriel <arend@broadcom.com> Thanks, 2 patches applied to wireless-drivers-next.git: cb700df8c8a6 brcmfmac: fix double free of p2pdev interface 40b503c76481 brcmfmac: make brcmf_p2p_detach() call conditional Kalle Valo -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c index 2e1598f..a9ba775 100644 --- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c +++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c @@ -2140,7 +2140,7 @@ static void brcmf_p2p_delete_p2pdev(struct brcmf_p2p_info *p2p, { cfg80211_unregister_wdev(&vif->wdev); p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL; - kfree(vif->ifp); + brcmf_remove_interface(vif->ifp->drvr, vif->ifp->bssidx); brcmf_free_vif(vif); }
When freeing the driver ifp pointer it should also be removed from the driver interface list, which is what brcmf_remove_interface() does. Otherwise, the ifp pointer will be freed twice triggering a kernel oops. Fixes: f37d69a4babc ("brcmfmac: free ifp for non-netdev interface in p2p module") Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com> Reviewed-by: Hante Meuleman <meuleman@broadcom.com> Signed-off-by: Arend van Spriel <arend@broadcom.com> --- drivers/net/wireless/brcm80211/brcmfmac/p2p.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)