diff options
| author | sruffell <sruffell@5390a7c7-147a-4af0-8ec9-7488f05a26cb> | 2008-01-02 15:20:56 +0000 |
|---|---|---|
| committer | sruffell <sruffell@5390a7c7-147a-4af0-8ec9-7488f05a26cb> | 2008-01-02 15:20:56 +0000 |
| commit | df19a0df6dab13f2be16680f039f0fe68a778198 (patch) | |
| tree | 5dc97b84f36569044129b3e3f60c1793986892fa /wcte12xp | |
| parent | 9a2cb6e6a6209d8efc6c8e1c991ebdbb286baca7 (diff) | |
Move the release of VPMADT032 resources to after the interrupt handler has been freed. Closes a
small window of opportunity for NULL pointer access at driver unload time.
git-svn-id: http://svn.digium.com/svn/zaptel/branches/1.2@3586 5390a7c7-147a-4af0-8ec9-7488f05a26cb
Diffstat (limited to 'wcte12xp')
| -rw-r--r-- | wcte12xp/base.c | 20 |
1 files changed, 11 insertions, 9 deletions
diff --git a/wcte12xp/base.c b/wcte12xp/base.c index 26598be..eb9ea6a 100644 --- a/wcte12xp/base.c +++ b/wcte12xp/base.c @@ -1979,16 +1979,8 @@ static void __devexit te12xp_remove_one(struct pci_dev *pdev) clear_bit(VPM150M_ACTIVE, &vpm150m->control); flush_workqueue(vpm150m->wq); destroy_workqueue(vpm150m->wq); - - kfree(wc->vpm150m); - - spin_lock_irqsave(&wc->reglock, flags); - wc->vpm150m = NULL; - vpm150m->wc = NULL; - spin_unlock_irqrestore(&wc->reglock, flags); } #endif - /* Stop any DMA */ t1_stop_dma(wc); @@ -1999,8 +1991,18 @@ static void __devexit te12xp_remove_one(struct pci_dev *pdev) debug_printk(1, "isrreaderrors=%d\n", wc->isrreaderrors); /* Immediately free resources */ - pci_free_consistent(pdev, PCI_WINDOW_SIZE, (void *)wc->writechunk, wc->writedma); free_irq(pdev->irq, wc); + pci_free_consistent(pdev, PCI_WINDOW_SIZE, (void *)wc->writechunk, wc->writedma); + +#ifdef VPM_SUPPORT + if(vpm150m) { + spin_lock_irqsave(&wc->reglock, flags); + wc->vpm150m = NULL; + vpm150m->wc = NULL; + spin_unlock_irqrestore(&wc->reglock, flags); + kfree(wc->vpm150m); + } +#endif /* Release span, possibly delayed */ if (!wc->usecount) |