From f3c5b4820d7f043113541645db9b3e71bb0738c3 Mon Sep 17 00:00:00 2001 From: Deren Wu Date: Sat, 13 Jan 2024 17:00:23 +0800 Subject: [PATCH] wifi: mt76: mt7925e: fix use-after-free in free_irq() From commit a304e1b82808 ("[PATCH] Debug shared irqs"), there is a test to make sure the shared irq handler should be able to handle the unexpected event after deregistration. For this case, let's apply MT76_REMOVED flag to indicate the device was removed and do not run into the resource access anymore. Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Signed-off-by: Deren Wu Signed-off-by: Felix Fietkau --- mt7925/pci.c | 1 + 1 file changed, 1 insertion(+) diff --git a/mt7925/pci.c b/mt7925/pci.c index 7661098a..3d125dd5 100644 --- a/mt7925/pci.c +++ b/mt7925/pci.c @@ -427,6 +427,7 @@ static void mt7925_pci_remove(struct pci_dev *pdev) struct mt792x_dev *dev = container_of(mdev, struct mt792x_dev, mt76); mt7925e_unregister_device(dev); + set_bit(MT76_REMOVED, &mdev->phy.state); devm_free_irq(&pdev->dev, pdev->irq, dev); mt76_free_device(&dev->mt76); pci_free_irq_vectors(pdev);