> Trying to probe a mt7921e pci card without firmware results in a > successful probe where ieee80211_register_hw hasn't been called. When > removing the driver, ieee802111_unregister_hw is called unconditionally > leading to a kernel NULL pointer dereference. > Fix the issue running mt76_unregister_device routine just for registered > hw. Reviewing the code better, mt7921 is the only driver registering ieee80211_hw in init work. I do not have a strong opinion if it is better this approach or the fix posted by Helmut, I am fine both ways. @Felix: what do you think? Regards, Lorenzo > > Link: https://bugs.debian.org/1029116 > Link: https://bugs.kali.org/view.php?id=8140 > Reported-by: Stuart Hayhurst <stuart.a.hayhurst@xxxxxxxxx> > Fixes: 1c71e03afe4b ("mt76: mt7921: move mt7921_init_hw in a dedicated work") > Tested-by: Helmut Grohne <helmut@xxxxxxxxxxxx> > Signed-off-by: Lorenzo Bianconi <lorenzo@xxxxxxxxxx> > --- > drivers/net/wireless/mediatek/mt76/mac80211.c | 8 ++++++++ > drivers/net/wireless/mediatek/mt76/mt76.h | 1 + > 2 files changed, 9 insertions(+) > > diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c > index b117e4467c87..34abf70f44af 100644 > --- a/drivers/net/wireless/mediatek/mt76/mac80211.c > +++ b/drivers/net/wireless/mediatek/mt76/mac80211.c > @@ -539,6 +539,7 @@ int mt76_register_phy(struct mt76_phy *phy, bool vht, > if (ret) > return ret; > > + set_bit(MT76_STATE_REGISTERED, &phy->state); > phy->dev->phys[phy->band_idx] = phy; > > return 0; > @@ -549,6 +550,9 @@ void mt76_unregister_phy(struct mt76_phy *phy) > { > struct mt76_dev *dev = phy->dev; > > + if (!test_bit(MT76_STATE_REGISTERED, &phy->state)) > + return; > + > if (IS_ENABLED(CONFIG_MT76_LEDS)) > mt76_led_cleanup(phy); > mt76_tx_status_check(dev, true); > @@ -719,6 +723,7 @@ int mt76_register_device(struct mt76_dev *dev, bool vht, > return ret; > > WARN_ON(mt76_worker_setup(hw, &dev->tx_worker, NULL, "tx")); > + set_bit(MT76_STATE_REGISTERED, &phy->state); > sched_set_fifo_low(dev->tx_worker.task); > > return 0; > @@ -729,6 +734,9 @@ void mt76_unregister_device(struct mt76_dev *dev) > { > struct ieee80211_hw *hw = dev->hw; > > + if (!test_bit(MT76_STATE_REGISTERED, &dev->phy.state)) > + return; > + > if (IS_ENABLED(CONFIG_MT76_LEDS)) > mt76_led_cleanup(&dev->phy); > mt76_tx_status_check(dev, true); > diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h > index ccca0162c8f8..183b0fc5a2d4 100644 > --- a/drivers/net/wireless/mediatek/mt76/mt76.h > +++ b/drivers/net/wireless/mediatek/mt76/mt76.h > @@ -402,6 +402,7 @@ struct mt76_tx_cb { > > enum { > MT76_STATE_INITIALIZED, > + MT76_STATE_REGISTERED, > MT76_STATE_RUNNING, > MT76_STATE_MCU_RUNNING, > MT76_SCANNING, > -- > 2.39.2 >
Attachment:
signature.asc
Description: PGP signature
