diff options
| author | Arend van Spriel <arend@broadcom.com> | 2015-06-15 23:48:38 +0300 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2015-06-16 11:35:09 +0300 |
| commit | cb700df8c8a62061b573322c4d0b292a9010aa3c (patch) | |
| tree | 9420f39ae901a04f23a76eaa1c4876ef3e68911f /drivers | |
| parent | 323d8f1be18e7cef53027c24e46308900dc7a90c (diff) | |
| download | linux-cb700df8c8a62061b573322c4d0b292a9010aa3c.tar.xz | |
brcmfmac: fix double free of p2pdev interface
When freeing the driver ifp pointer it should also be removed from
the driver interface list, which is what brcmf_remove_interface()
does. Otherwise, the ifp pointer will be freed twice triggering
a kernel oops.
Fixes: f37d69a4babc ("brcmfmac: free ifp for non-netdev interface in p2p module")
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/wireless/brcm80211/brcmfmac/p2p.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c index 2e1598f76d4b..a9ba775a24c1 100644 --- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c +++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c @@ -2140,7 +2140,7 @@ static void brcmf_p2p_delete_p2pdev(struct brcmf_p2p_info *p2p, { cfg80211_unregister_wdev(&vif->wdev); p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL; - kfree(vif->ifp); + brcmf_remove_interface(vif->ifp->drvr, vif->ifp->bssidx); brcmf_free_vif(vif); } |