netdev - [PATCH] wifi: mt76: mt7921: correctly handle removal in the absence of firmware

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <Y/Ss5LYSYG2M7jSq@alf.mars>
Date:   Tue, 21 Feb 2023 12:37:08 +0100
From:   Helmut Grohne <helmut@...divi.de>
To:     Felix Fietkau <nbd@....name>,
        Lorenzo Bianconi <lorenzo@...nel.org>,
        Ryder Lee <ryder.lee@...iatek.com>,
        linux-wireless@...r.kernel.org,
        Stuart Hayhurst <stuart.a.hayhurst@...il.com>
Cc:     Shayne Chen <shayne.chen@...iatek.com>,
        Sean Wang <sean.wang@...iatek.com>,
        Deren Wu <deren.wu@...iatek.com>, netdev@...r.kernel.org,
        1029116@...s.debian.org
Subject: [PATCH] wifi: mt76: mt7921: correctly handle removal in the absence
 of firmware

Trying to probe a mt7921e pci card without firmware results in a
successful probe where ieee80211_register_hw hasn't been called. When
removing the driver, ieee802111_unregister_hw is called unconditionally
leading to a kernel NULL pointer dereference among other things.

As with other drivers that delay registration after probe, we track the
registration state in a flag variable and conidtionalize deregistration.

Link: https://bugs.debian.org/1029116
Link: https://bugs.kali.org/view.php?id=8140
Reported-by: Stuart Hayhurst <stuart.a.hayhurst@...il.com>
Fixes: 1c71e03afe4b ("mt76: mt7921: move mt7921_init_hw in a dedicated work")
Signed-off-by: Helmut Grohne <helmut@...exian.com>
Cc: stable@...r.kernel.org
Sponsored-by: Freexian and Offensive Security
---
 drivers/net/wireless/mediatek/mt76/mt7921/init.c   | 1 +
 drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h | 1 +
 drivers/net/wireless/mediatek/mt76/mt7921/pci.c    | 3 ++-
 drivers/net/wireless/mediatek/mt76/mt7921/sdio.c   | 3 ++-
 drivers/net/wireless/mediatek/mt76/mt7921/usb.c    | 3 ++-
 5 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/init.c b/drivers/net/wireless/mediatek/mt76/mt7921/init.c
index 542dfd425129..d5438212d5ff 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/init.c
@@ -315,6 +315,7 @@ static void mt7921_init_work(struct work_struct *work)
 		dev_err(dev->mt76.dev, "register device failed\n");
 		return;
 	}
+	dev->hw_registered = true;
 
 	ret = mt7921_init_debugfs(dev);
 	if (ret) {
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
index 15d6b7fe1c6c..e3b5d8ebf243 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
@@ -288,6 +288,7 @@ struct mt7921_dev {
 	bool hw_full_reset:1;
 	bool hw_init_done:1;
 	bool fw_assert:1;
+	bool hw_registered:1;
 
 	struct list_head sta_poll_list;
 	spinlock_t sta_poll_lock;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
index cb72ded37256..1841eb7345dc 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
@@ -110,7 +110,8 @@ static void mt7921e_unregister_device(struct mt7921_dev *dev)
 	struct mt76_connac_pm *pm = &dev->pm;
 
 	cancel_work_sync(&dev->init_work);
-	mt76_unregister_device(&dev->mt76);
+	if (dev->hw_registered)
+		mt76_unregister_device(&dev->mt76);
 	mt76_for_each_q_rx(&dev->mt76, i)
 		napi_disable(&dev->mt76.napi[i]);
 	cancel_delayed_work_sync(&pm->ps_work);
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c b/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c
index 8ce4252b8ae7..23a9dd3c6450 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c
@@ -43,7 +43,8 @@ static void mt7921s_unregister_device(struct mt7921_dev *dev)
 	struct mt76_connac_pm *pm = &dev->pm;
 
 	cancel_work_sync(&dev->init_work);
-	mt76_unregister_device(&dev->mt76);
+	if (dev->hw_registered)
+		mt76_unregister_device(&dev->mt76);
 	cancel_delayed_work_sync(&pm->ps_work);
 	cancel_work_sync(&pm->wake_work);
 
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/usb.c b/drivers/net/wireless/mediatek/mt76/mt7921/usb.c
index 5321d20dcdcb..e55e1b50f760 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/usb.c
@@ -301,7 +301,8 @@ static void mt7921u_disconnect(struct usb_interface *usb_intf)
 	if (!test_bit(MT76_STATE_INITIALIZED, &dev->mphy.state))
 		return;
 
-	mt76_unregister_device(&dev->mt76);
+	if (dev->hw_registered)
+		mt76_unregister_device(&dev->mt76);
 	mt7921u_cleanup(dev);
 
 	usb_set_intfdata(usb_intf, NULL);
-- 
2.39.0