[PATCH 1/2] wifi: ipw2100: drain IRQ tasklet during teardown

[Jiale Yao]

The interrupt handler can queue irq_tasklet immediately before teardown
frees the IRQ.  free_irq() prevents new hard IRQ handlers, but it does
not drain a tasklet that was already queued.  The tasklet can therefore
access queues or MMIO after the remove and probe failure paths release
them.

Kill the tasklet after freeing the IRQ and before releasing resources it
can access.

Fixes: 2c86c275015c ("Add ipw2100 wireless driver.")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 drivers/net/wireless/intel/ipw2x00/ipw2100.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2100.c b/drivers/net/wireless/intel/ipw2x00/ipw2100.c
index 43b4e432956b..44c76f1789d2 100644
--- a/drivers/net/wireless/intel/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/intel/ipw2x00/ipw2100.c
@@ -6300,6 +6300,7 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
 
 		if (dev->irq)
 			free_irq(dev->irq, priv);
+		tasklet_kill(&priv->irq_tasklet);
 
 		ipw2100_kill_works(priv);
 
@@ -6346,6 +6347,9 @@ static void ipw2100_pci_remove_one(struct pci_dev *pci_dev)
 	 * FIXME: remove the comment above. */
 	unregister_netdev(dev);
 
+	free_irq(dev->irq, priv);
+	tasklet_kill(&priv->irq_tasklet);
+
 	ipw2100_kill_works(priv);
 
 	ipw2100_queues_free(priv);
@@ -6353,8 +6357,6 @@ static void ipw2100_pci_remove_one(struct pci_dev *pci_dev)
 	/* Free potential debugging firmware snapshot */
 	ipw2100_snapshot_free(priv);
 
-	free_irq(dev->irq, priv);
-
 	pci_iounmap(pci_dev, priv->ioaddr);
 
 	/* wiphy_unregister needs to be here, before free_libipw */
-- 
2.34.1