From: Michael Buesch <mbuesch@freenet.de>
Date: Tue, 14 Mar 2006 15:05:26 +0000 (+0100)
Subject: [PATCH] bcm43xx: Fix crash on ifdown, by being careful in pio/dma freeing.
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=49f29efa7f44a79b64c7882c68e171898d0495a0;p=GitHub%2Fmt8127%2Fandroid_kernel_alcatel_ttab.git

[PATCH] bcm43xx: Fix crash on ifdown, by being careful in pio/dma freeing.

This bug was caused by the packing of the bcm43xx_dma and bcm43xx_pio
structures into a union.

Signed-off-by: Michael Buesch <mbuesch@freenet.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---

diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_dma.c b/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
index 7ed368a587f3..9c64438b767f 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
@@ -531,7 +531,11 @@ static void bcm43xx_destroy_dmaring(struct bcm43xx_dmaring *ring)
 
 void bcm43xx_dma_free(struct bcm43xx_private *bcm)
 {
-	struct bcm43xx_dma *dma = bcm43xx_current_dma(bcm);
+	struct bcm43xx_dma *dma;
+
+	if (bcm43xx_using_pio(bcm))
+		return;
+	dma = bcm43xx_current_dma(bcm);
 
 	bcm43xx_destroy_dmaring(dma->rx_ring1);
 	dma->rx_ring1 = NULL;
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_pio.c b/drivers/net/wireless/bcm43xx/bcm43xx_pio.c
index 7bddae910de9..5b6f0a84d017 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_pio.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_pio.c
@@ -377,7 +377,11 @@ static void bcm43xx_destroy_pioqueue(struct bcm43xx_pioqueue *queue)
 
 void bcm43xx_pio_free(struct bcm43xx_private *bcm)
 {
-	struct bcm43xx_pio *pio = bcm43xx_current_pio(bcm);
+	struct bcm43xx_pio *pio;
+
+	if (!bcm43xx_using_pio(bcm))
+		return;
+	pio = bcm43xx_current_pio(bcm);
 
 	bcm43xx_destroy_pioqueue(pio->queue3);
 	pio->queue3 = NULL;