From 3af373021fa32f8f787bfbdcc1a9277a287bde4e Mon Sep 17 00:00:00 2001
From: Stefano Panella <stefano.panella@csr.com>
Date: Tue, 23 Dec 2008 12:31:09 +0000
Subject: [PATCH] uwb: remove beacon cache entry after calling uwb_notify()
Removing the beacon cache entry from a uwb_dev can cause an oops if the
bce is released before the call to uwb_notify().
Signed-off-by: Stefano Panella <stefano.panella@csr.com>
Signed-off-by: David Vrabel <david.vrabel@csr.com>
---
drivers/uwb/beacon.c | 2 --
drivers/uwb/lc-dev.c | 2 ++
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/uwb/beacon.c b/drivers/uwb/beacon.c
index 0315093e2216..36bc3158006f 100644
--- a/drivers/uwb/beacon.c
+++ b/drivers/uwb/beacon.c
@@ -289,8 +289,6 @@ void uwb_beca_purge(struct uwb_rc *rc)
expires = bce->ts_jiffies + msecs_to_jiffies(beacon_timeout_ms);
if (time_after(jiffies, expires)) {
uwbd_dev_offair(bce);
- list_del(&bce->node);
- uwb_bce_put(bce);
}
}
mutex_unlock(&rc->uwb_beca.mutex);
diff --git a/drivers/uwb/lc-dev.c b/drivers/uwb/lc-dev.c
index f78087b85918..e9fe1bb7eb23 100644
--- a/drivers/uwb/lc-dev.c
+++ b/drivers/uwb/lc-dev.c
@@ -375,6 +375,8 @@ int __uwb_dev_offair(struct uwb_dev *uwb_dev, struct uwb_rc *rc)
rc ? rc->uwb_dev.dev.parent->bus->name : "n/a",
rc ? dev_name(rc->uwb_dev.dev.parent) : "");
uwb_dev_rm(uwb_dev);
+ list_del(&uwb_dev->bce->node);
+ uwb_bce_put(uwb_dev->bce);
uwb_dev_put(uwb_dev); /* for the creation in _onair() */
return 0;
--
GitLab