package/kernel/mac80211/patches/390-0001-brcmfmac-fix-double-free-of-p2pdev-interface.patch

   1 From: Arend van Spriel <arend@broadcom.com>
   2 Date: Mon, 15 Jun 2015 22:48:38 +0200
   3 Subject: [PATCH] brcmfmac: fix double free of p2pdev interface
   4
   5 When freeing the driver ifp pointer it should also be removed from
   6 the driver interface list, which is what brcmf_remove_interface()
   7 does. Otherwise, the ifp pointer will be freed twice triggering
   8 a kernel oops.
   9
  10 Fixes: f37d69a4babc ("brcmfmac: free ifp for non-netdev interface in p2p module")
  11 Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
  12 Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
  13 Signed-off-by: Arend van Spriel <arend@broadcom.com>
  14 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  15 ---
  16
  17 --- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
  18 +++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
  19 @@ -2140,7 +2140,7 @@ static void brcmf_p2p_delete_p2pdev(stru
  20  {
  21         cfg80211_unregister_wdev(&vif->wdev);
  22         p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
  23 -       kfree(vif->ifp);
  24 +       brcmf_remove_interface(vif->ifp->drvr, vif->ifp->bssidx);
  25         brcmf_free_vif(vif);
  26  }
  27