The last command used to shutdown firmware might be timeout, and trigger firmware dump in asynchronous pcie/sdio work. The remove/shutdown handler will continue free core data structure private/adapter, which might be dereferenced in pcie/sdio work, finally crash the kernel. Sync and Cancel pcie/sdio work, could be a fix for above cornel case. In this way, the last command timeout could be handled properly. Signed-off-by: Xinming Hu <huxm@xxxxxxxxxxx> --- drivers/net/wireless/marvell/mwifiex/pcie.c | 2 ++ drivers/net/wireless/marvell/mwifiex/sdio.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c index f666cb2..23209c5 100644 --- a/drivers/net/wireless/marvell/mwifiex/pcie.c +++ b/drivers/net/wireless/marvell/mwifiex/pcie.c @@ -310,6 +310,8 @@ static void mwifiex_pcie_remove(struct pci_dev *pdev) mwifiex_init_shutdown_fw(priv, MWIFIEX_FUNC_SHUTDOWN); } + cancel_work_sync(&card->work); + mwifiex_remove_card(adapter); } diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c index a828801..2488587 100644 --- a/drivers/net/wireless/marvell/mwifiex/sdio.c +++ b/drivers/net/wireless/marvell/mwifiex/sdio.c @@ -399,6 +399,8 @@ static int mwifiex_check_winner_status(struct mwifiex_adapter *adapter) mwifiex_init_shutdown_fw(priv, MWIFIEX_FUNC_SHUTDOWN); } + cancel_work_sync(&card->work); + mwifiex_remove_card(adapter); } -- 1.9.1
