On Fri, Apr 06, 2018 at 10:37:29PM -0700, João Paulo Rechi Vita wrote: > When the module is removed the led workqueue is destroyed in the remove > callback, before the led device is unregistered from the led subsystem. > > This leads to a NULL pointer derefence when the led device is > unregistered automatically later as part of the module removal cleanup. > Bellow is the backtrace showing the problem. > Thanks João Paulo, ... > Unregistering the led device on the remove callback before destroying the > workqueue avoids this problem. > > https://bugzilla.kernel.org/show_bug.cgi?id=196097 > > Reported-by: Dun Hum <bitter.taste@xxxxxxx> > Signed-off-by: João Paulo Rechi Vita <jprvita@xxxxxxxxxxxx> > --- > drivers/platform/x86/asus-wireless.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/platform/x86/asus-wireless.c b/drivers/platform/x86/asus-wireless.c > index 343e12547660..ecd715c82de5 100644 > --- a/drivers/platform/x86/asus-wireless.c > +++ b/drivers/platform/x86/asus-wireless.c > @@ -181,6 +181,7 @@ static int asus_wireless_remove(struct acpi_device *adev) > { > struct asus_wireless_data *data = acpi_driver_data(adev); > > + devm_led_classdev_unregister(&adev->dev, &data->led); > if (data->wq) > destroy_workqueue(data->wq); > return 0; asus_wireless_add only calls devm_led_classdev_register() iff the workqueue is successfully created. It seems like it would make sense to move the devm_led_classdev_unregister() call within the 'if (data->wq)' condition block. This should also cc stable. Thanks, -- Darren Hart VMware Open Source Technology Center
