b43: fix invalid memory access in b43_ssb_remove()

wldev is freed in b43_one_core_detach() and should not be accessed after
that call.  Keep wldev->dev in a local variable.

Signed-off-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index d9f53b791b215df09db0524ca613656274bfc213..85d6a1f03a08923c227a3516c4b4d080f7b0e519 100644 (file)
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -5350,6 +5350,7 @@ static void b43_ssb_remove(struct ssb_device *sdev)
 {
        struct b43_wl *wl = ssb_get_devtypedata(sdev);
        struct b43_wldev *wldev = ssb_get_drvdata(sdev);
+       struct b43_bus_dev *dev = wldev->dev;
 
        /* We must cancel any work here before unregistering from ieee80211,
         * as the ieee80211 unreg will destroy the workqueue. */
@@ -5365,14 +5366,14 @@ static void b43_ssb_remove(struct ssb_device *sdev)
                ieee80211_unregister_hw(wl->hw);
        }
 
-       b43_one_core_detach(wldev->dev);
+       b43_one_core_detach(dev);
 
        if (list_empty(&wl->devlist)) {
                b43_leds_unregister(wl);
                /* Last core on the chip unregistered.
                 * We can destroy common struct b43_wl.
                 */
-               b43_wireless_exit(wldev->dev, wl);
+               b43_wireless_exit(dev, wl);
        }
 }