Skip to content

Commit

Permalink
wifi: mt76: do not run mt76_unregister_device() on unregistered hw
Browse files Browse the repository at this point in the history
Trying to probe a mt7921e pci card without firmware results in a
successful probe where ieee80211_register_hw hasn't been called. When
removing the driver, ieee802111_unregister_hw is called unconditionally
leading to a kernel NULL pointer dereference.
Fix the issue running mt76_unregister_device routine just for registered
hw.

Link: https://bugs.debian.org/1029116
Link: https://bugs.kali.org/view.php?id=8140
Reported-by: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
Fixes: 1c71e03afe4b ("mt76: mt7921: move mt7921_init_hw in a dedicated work")
Tested-by: Helmut Grohne <helmut@freexian.com>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
  • Loading branch information
LorenzoBianconi authored and nbd168 committed Mar 1, 2023
1 parent eff7666 commit 920bc6e
Show file tree
Hide file tree
Showing 2 changed files with 9 additions and 0 deletions.
8 changes: 8 additions & 0 deletions mac80211.c
Original file line number Diff line number Diff line change
Expand Up @@ -540,6 +540,7 @@ int mt76_register_phy(struct mt76_phy *phy, bool vht,
if (ret)
return ret;

set_bit(MT76_STATE_REGISTERED, &phy->state);
phy->dev->phys[phy->band_idx] = phy;

return 0;
Expand All @@ -550,6 +551,9 @@ void mt76_unregister_phy(struct mt76_phy *phy)
{
struct mt76_dev *dev = phy->dev;

if (!test_bit(MT76_STATE_REGISTERED, &phy->state))
return;

if (IS_ENABLED(CONFIG_MT76_LEDS))
mt76_led_cleanup(phy);
mt76_tx_status_check(dev, true);
Expand Down Expand Up @@ -720,6 +724,7 @@ int mt76_register_device(struct mt76_dev *dev, bool vht,
return ret;

WARN_ON(mt76_worker_setup(hw, &dev->tx_worker, NULL, "tx"));
set_bit(MT76_STATE_REGISTERED, &phy->state);
sched_set_fifo_low(dev->tx_worker.task);

return 0;
Expand All @@ -730,6 +735,9 @@ void mt76_unregister_device(struct mt76_dev *dev)
{
struct ieee80211_hw *hw = dev->hw;

if (!test_bit(MT76_STATE_REGISTERED, &dev->phy.state))
return;

if (IS_ENABLED(CONFIG_MT76_LEDS))
mt76_led_cleanup(&dev->phy);
mt76_tx_status_check(dev, true);
Expand Down
1 change: 1 addition & 0 deletions mt76.h
Original file line number Diff line number Diff line change
Expand Up @@ -402,6 +402,7 @@ struct mt76_tx_cb {

enum {
MT76_STATE_INITIALIZED,
MT76_STATE_REGISTERED,
MT76_STATE_RUNNING,
MT76_STATE_MCU_RUNNING,
MT76_SCANNING,
Expand Down

0 comments on commit 920bc6e

Please sign in to comment.