From 560ce3087292603dafb2603ee12cab0ff6c20aee Mon Sep 17 00:00:00 2001 From: Vladimir Kondratiev Date: Wed, 6 Aug 2014 10:32:01 +0300 Subject: [PATCH] wil6210: fix access after free in wil_pcie_remove() 'wil' released in wil_if_free(); save iomapped address aside to properly unmap it. Signed-off-by: Vladimir Kondratiev Signed-off-by: John W. Linville --- drivers/net/wireless/ath/wil6210/pcie_bus.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/wil6210/pcie_bus.c b/drivers/net/wireless/ath/wil6210/pcie_bus.c index cf0b21987d7..38dcbea49d4 100644 --- a/drivers/net/wireless/ath/wil6210/pcie_bus.c +++ b/drivers/net/wireless/ath/wil6210/pcie_bus.c @@ -218,12 +218,13 @@ static int wil_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id) static void wil_pcie_remove(struct pci_dev *pdev) { struct wil6210_priv *wil = pci_get_drvdata(pdev); + void __iomem *csr = wil->csr; wil6210_debugfs_remove(wil); wil_if_pcie_disable(wil); wil_if_remove(wil); wil_if_free(wil); - pci_iounmap(pdev, wil->csr); + pci_iounmap(pdev, csr); pci_release_region(pdev, 0); pci_disable_device(pdev); } -- 2.46.0