Commit 41130c32 authored by Lorenzo Bianconi's avatar Lorenzo Bianconi Committed by Kalle Valo
Browse files

wifi: mt76: do not run mt76_unregister_device() on unregistered hw 

Trying to probe a mt7921e pci card without firmware results in a
successful probe where ieee80211_register_hw hasn't been called. When
removing the driver, ieee802111_unregister_hw is called unconditionally
leading to a kernel NULL pointer dereference.
Fix the issue running mt76_unregister_device routine just for registered
hw.

Link: https://bugs.debian.org/1029116
Link: https://bugs.kali.org/view.php?id=8140


Reported-by: default avatarStuart Hayhurst <stuart.a.hayhurst@gmail.com>
Fixes: 1c71e03a ("mt76: mt7921: move mt7921_init_hw in a dedicated work")
Tested-by: default avatarHelmut Grohne <helmut@freexian.com>
Signed-off-by: default avatarLorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: default avatarKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/be3457d82f4e44bb71a22b2b5db27b644a37b1e1.1677107277.git.lorenzo@kernel.org
parent 96c06950

drivers/net/wireless/mediatek/mt76/mac80211.c

+8 −0
Original line number Diff line number Diff line
@@ -539,6 +539,7 @@ int mt76_register_phy(struct mt76_phy *phy, bool vht, 
	if (ret)

		return ret;



	set_bit(MT76_STATE_REGISTERED, &phy->state);

	phy->dev->phys[phy->band_idx] = phy;



	return 0;
@@ -549,6 +550,9 @@ void mt76_unregister_phy(struct mt76_phy *phy) 
{

	struct mt76_dev *dev = phy->dev;



	if (!test_bit(MT76_STATE_REGISTERED, &phy->state))

		return;



	if (IS_ENABLED(CONFIG_MT76_LEDS))

		mt76_led_cleanup(phy);

	mt76_tx_status_check(dev, true);
@@ -719,6 +723,7 @@ int mt76_register_device(struct mt76_dev *dev, bool vht, 
		return ret;



	WARN_ON(mt76_worker_setup(hw, &dev->tx_worker, NULL, "tx"));

	set_bit(MT76_STATE_REGISTERED, &phy->state);

	sched_set_fifo_low(dev->tx_worker.task);



	return 0;
@@ -729,6 +734,9 @@ void mt76_unregister_device(struct mt76_dev *dev) 
{

	struct ieee80211_hw *hw = dev->hw;



	if (!test_bit(MT76_STATE_REGISTERED, &dev->phy.state))

		return;



	if (IS_ENABLED(CONFIG_MT76_LEDS))

		mt76_led_cleanup(&dev->phy);

	mt76_tx_status_check(dev, true);

drivers/net/wireless/mediatek/mt76/mt76.h

+1 −0
Original line number Diff line number Diff line
@@ -402,6 +402,7 @@ struct mt76_tx_cb { 


enum {

	MT76_STATE_INITIALIZED,

	MT76_STATE_REGISTERED,

	MT76_STATE_RUNNING,

	MT76_STATE_MCU_RUNNING,

	MT76_SCANNING,