iwm - Fix race during detach, where a callout is left after driver is gone.
authorImre Vadász <imre@vdsz.com>
Wed, 6 Jun 2018 21:32:36 +0000 (23:32 +0200)
committerImre Vadász <imre@vdsz.com>
Thu, 20 Sep 2018 14:08:45 +0000 (16:08 +0200)
sys/dev/netif/iwm/if_iwm.c
sys/dev/netif/iwm/if_iwm_led.c

index f3e78bf..1630ca7 100644 (file)
@@ -4851,6 +4851,9 @@ iwm_watchdog(void *arg)
 {
        struct iwm_softc *sc = arg;
 
+       if (sc->sc_attached == 0)
+               return;
+
        if (sc->sc_tx_timer > 0) {
                if (--sc->sc_tx_timer == 0) {
                        device_printf(sc->sc_dev, "device timeout\n");
@@ -6424,8 +6427,6 @@ iwm_detach_local(struct iwm_softc *sc, int do_net80211)
        if (do_net80211) {
                ieee80211_draintask(&sc->sc_ic, &sc->sc_es_task);
        }
-       callout_drain(&sc->sc_led_blink_to);
-       callout_drain(&sc->sc_watchdog_to);
        iwm_stop_device(sc);
        if (do_net80211) {
                IWM_LOCK(sc);
@@ -6433,6 +6434,8 @@ iwm_detach_local(struct iwm_softc *sc, int do_net80211)
                IWM_UNLOCK(sc);
                ieee80211_ifdetach(&sc->sc_ic);
        }
+       callout_drain(&sc->sc_led_blink_to);
+       callout_drain(&sc->sc_watchdog_to);
 
        iwm_phy_db_free(sc->sc_phy_db);
        sc->sc_phy_db = NULL;
index c59d981..d01cd54 100644 (file)
@@ -157,6 +157,9 @@ iwm_led_blink_timeout(void *arg)
 {
        struct iwm_softc *sc = arg;
 
+       if (sc->sc_attached == 0)
+               return;
+
        if (iwm_mvm_led_is_enabled(sc))
                iwm_mvm_led_disable(sc);
        else