[PATCH] pcmcia: bcm63xx: unregister socket before freeing it

[Avi Weiss]

bcm63xx_drv_pcmcia_remove() stops the polling timer and frees the
socket without unregistering it from the PCMCIA core. This leaves the
socket on the core's list with its thread and device still active,
referencing freed driver state.

Unregister the socket after stopping the timer and before releasing
its resources.

Fixes: 553d6d5f5b84 ("MIPS: BCM63xx: Add PCMCIA & Cardbus support.")
Signed-off-by: Avi Weiss <thnkslprpt@xxxxxxxxx>
---
 1 file changed, 1 insertion(+)

diff --git a/drivers/pcmcia/bcm63xx_pcmcia.c b/drivers/pcmcia/bcm63xx_pcmcia.c
index 1612b5d76975..275593a2852c 100644
--- a/drivers/pcmcia/bcm63xx_pcmcia.c
+++ b/drivers/pcmcia/bcm63xx_pcmcia.c
@@ -444,6 +444,7 @@ static void bcm63xx_drv_pcmcia_remove(struct platform_device *pdev)
 
 	skt = platform_get_drvdata(pdev);
 	timer_shutdown_sync(&skt->timer);
+	pcmcia_unregister_socket(&skt->socket);
 	iounmap(skt->base);
 	iounmap(skt->io_base);
 	res = skt->reg_res;

base-commit: d135ab453a7400a34930bdda1ef4bdc8acfac80e
-- 
2.43.0