• Brian Norris's avatar
    mwifiex: catch mwifiex_fw_dpc() errors properly in reset · 755b37c9
    Brian Norris authored
    When resetting the device, we take a synchronous firmware-loading code
    path, which borrows a lot from the asynchronous path used at probe time.
    We don't catch errors correctly though, which means that in the PCIe
    driver, we may try to dereference the 'adapter' struct after
    mwifiex_fw_dpc() has freed it. See this (erronous) print in
    mwifiex_pcie_reset_notify():
    
    	mwifiex_dbg(adapter, INFO, "%s, successful\n", __func__);
    
    Let's instead refactor the synchronous (or "!req_fw_nowait") path so
    that we propagate errors and handle them properly.
    
    This fixes a use-after-free issue in the PCIe driver, as well as a
    misleading debug message ("successful"). It looks like the SDIO driver
    doesn't have these problems, since it doesn't do anything after
    mwifiex_reinit_sw().
    
    Fixes: 4c5dae59 ("mwifiex: add PCIe function level reset support")
    Signed-off-by: default avatarBrian Norris <briannorris@chromium.org>
    Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
    755b37c9
sdio.c 69.5 KB