diff options
| author | Felix Fietkau <nbd@nbd.name> | 2026-07-27 15:04:22 +0000 |
|---|---|---|
| committer | Felix Fietkau <nbd@nbd.name> | 2026-08-01 14:49:43 +0000 |
| commit | 15b960014f24dce5388d4a2e7274e6490cb3c421 (patch) | |
| tree | b976581cd443a64846dd5ef7df3f14b716047a6a /drivers | |
| parent | 3ae8ad277e2819a281b0e36b55633c8515c16ce7 (diff) | |
| download | linux-next-15b960014f24dce5388d4a2e7274e6490cb3c421.tar.gz linux-next-15b960014f24dce5388d4a2e7274e6490cb3c421.zip | |
wifi: mt76: mt7915: fix ext PHY use-after-free on register error path
After mt7915_register_ext_phy() succeeded, a failure of the main PHY
mt7915_init_debugfs() or mt7915_coredump_register() unwound through
free_phy2, which called ieee80211_free_hw() on the ext PHY hw while it
was still registered with mac80211, since mt76_unregister_device() only
unregisters the main hw. Unregister the ext PHY (thermal + phy + hw)
first and skip the redundant free.
Fixes: 7b8e1ae886e4 ("mt76: mt7915: rework hardware/phy initialization")
Link: https://patch.msgid.link/20260727150434.1778520-3-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/wireless/mediatek/mt76/mt7915/init.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c index 0f6346731308..ca46a203aa48 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c @@ -1302,14 +1302,19 @@ int mt7915_register_device(struct mt7915_dev *dev) ret = mt7915_init_debugfs(&dev->phy); if (ret) - goto unreg_thermal; + goto unreg_ext_phy; ret = mt7915_coredump_register(dev); if (ret) - goto unreg_thermal; + goto unreg_ext_phy; return 0; +unreg_ext_phy: + if (phy2) { + mt7915_unregister_ext_phy(dev); + phy2 = NULL; + } unreg_thermal: mt7915_unregister_thermal(&dev->phy); unreg_dev: |