The interrupt handler can queue irq_tasklet immediately before teardown frees the IRQ. free_irq() prevents new hard IRQ handlers, but it does not drain a tasklet that was already queued. The tasklet can therefore access queues or MMIO after the remove and probe failure paths release them. Kill the tasklet after freeing the IRQ and before releasing resources it can access. Fixes: 2c86c275015c ("Add ipw2100 wireless driver.") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao --- drivers/net/wireless/intel/ipw2x00/ipw2100.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2100.c b/drivers/net/wireless/intel/ipw2x00/ipw2100.c index 43b4e432956b..44c76f1789d2 100644 --- a/drivers/net/wireless/intel/ipw2x00/ipw2100.c +++ b/drivers/net/wireless/intel/ipw2x00/ipw2100.c @@ -6300,6 +6300,7 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev, if (dev->irq) free_irq(dev->irq, priv); + tasklet_kill(&priv->irq_tasklet); ipw2100_kill_works(priv); @@ -6346,6 +6347,9 @@ static void ipw2100_pci_remove_one(struct pci_dev *pci_dev) * FIXME: remove the comment above. */ unregister_netdev(dev); + free_irq(dev->irq, priv); + tasklet_kill(&priv->irq_tasklet); + ipw2100_kill_works(priv); ipw2100_queues_free(priv); @@ -6353,8 +6357,6 @@ static void ipw2100_pci_remove_one(struct pci_dev *pci_dev) /* Free potential debugging firmware snapshot */ ipw2100_snapshot_free(priv); - free_irq(dev->irq, priv); - pci_iounmap(pci_dev, priv->ioaddr); /* wiphy_unregister needs to be here, before free_libipw */ -- 2.34.1