mirror of
https://github.com/outbackdingo/mt76.git
synced 2026-10-24 13:26:48 +00:00
mt76: mt7915: fix hwmon temp sensor mem use-after-free
Without this change, garbage is seen in the hwmon name and sensors output
for mt7915 is garbled. It appears that the hwmon logic does not make a
copy of the incoming string, but instead just copies a char* and expects
it to never go away.
Fixes: d6938251bb5b ("mt76: mt7915: add thermal sensor device support")
Signed-off-by: Ben Greear <[email protected]>
Signed-off-by: Ryder Lee <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
This commit is contained in:
committed by
Felix Fietkau
parent
80fe40c945
commit
c8f0d1d81d
+6
-4
@@ -160,9 +160,12 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
|
||||
struct wiphy *wiphy = phy->mt76->hw->wiphy;
|
||||
struct thermal_cooling_device *cdev;
|
||||
struct device *hwmon;
|
||||
const char *name;
|
||||
|
||||
cdev = thermal_cooling_device_register(wiphy_name(wiphy), phy,
|
||||
&mt7915_thermal_ops);
|
||||
name = devm_kasprintf(&wiphy->dev, GFP_KERNEL, "mt7915-%s",
|
||||
wiphy_name(wiphy));
|
||||
|
||||
cdev = thermal_cooling_device_register(name, phy, &mt7915_thermal_ops);
|
||||
if (!IS_ERR(cdev)) {
|
||||
if (sysfs_create_link(&wiphy->dev.kobj, &cdev->device.kobj,
|
||||
"cooling_device") < 0)
|
||||
@@ -174,8 +177,7 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
|
||||
if (!IS_REACHABLE(CONFIG_HWMON))
|
||||
return 0;
|
||||
|
||||
hwmon = devm_hwmon_device_register_with_groups(&wiphy->dev,
|
||||
wiphy_name(wiphy), phy,
|
||||
hwmon = devm_hwmon_device_register_with_groups(&wiphy->dev, name, phy,
|
||||
mt7915_hwmon_groups);
|
||||
if (IS_ERR(hwmon))
|
||||
return PTR_ERR(hwmon);
|
||||
|
||||
Reference in New Issue
Block a user