[PATCH] bcm43xx_d80211: Fix major memory corruption bug

[Pavel Roskin]

Set phy->lo_control to NULL whenever it's freed.  Failure to do so leads
to zeroing a block of memory that uses to hold *phy->lo_control, which
caused random crashes down the road.

Signed-off-by: Pavel Roskin <[EMAIL PROTECTED]>
---

 drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c 
b/drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c
index 3064322..62d4dc9 100644
--- a/drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c
+++ b/drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c
@@ -3048,6 +3048,7 @@ static void bcm43xx_wireless_core_exit(struct 
bcm43xx_wldev *dev)
        if (phy->dyn_tssi_tbl)
                kfree(phy->tssi2dbm);
        kfree(phy->lo_control);
+       phy->lo_control = NULL;
        ssb_chipco_set_clockmode(chipco, SSB_CLKMODE_SLOW);
        bcm43xx_vstack_free(&dev->genstack);
        bcm43xx_set_status(dev, BCM43xx_STAT_UNINIT);
@@ -3179,6 +3180,7 @@ err_kfree_tssitbl:
                kfree(phy->tssi2dbm);
 err_kfree_lo_control:
        kfree(phy->lo_control);
+       phy->lo_control = NULL;
 err_slowclock:
        ssb_chipco_set_clockmode(chipco, SSB_CLKMODE_SLOW);
        bcm43xx_set_status(dev, BCM43xx_STAT_UNINIT);

-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html