[PATCH] SER: mt7925: race condition in mt7925e_mac_reset allows compromised WiFi firmware to trigger host sk_buff use-after-free

[PATCH] SER: mt7925: race condition in mt7925e_mac_reset allows compromised WiFi firmware to trigger host sk_buff use-after-free

[Eason Lai]

From: Jeff Hsu <Jeff.Hsu@mediatek.com>

Fix racing condition in reset handler result sk_buff use-after-free

Signed-off-by: Jeff Hsu <Jeff.Hsu@mediatek.com>
---
 drivers/net/wireless/mediatek/mt76/mt7925/pci_mac.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/pci_mac.c b/drivers/net/wireless/mediatek/mt76/mt7925/pci_mac.c
index c3db814b2788..555eeb74d023 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/pci_mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/pci_mac.c
@@ -73,9 +73,11 @@ void mt7925_tx_token_put(struct mt792x_dev *dev)
 int mt7925e_mac_reset(struct mt792x_dev *dev)
 {
 	const struct mt792x_irq_map *irq_map = dev->irq_map;
+	struct mt76_phy *mphy = &dev->mt76.phy;
 	int i, err;
 
-	mt792xe_mcu_drv_pmctrl(dev);
+	__mt792xe_mcu_drv_pmctrl(dev);
+	clear_bit(MT76_STATE_PM, &mphy->state);
 
 	mt76_connac_free_pending_tx_skbs(&dev->pm, NULL);
 
-- 
2.45.2

Re: [PATCH] SER: mt7925: race condition in mt7925e_mac_reset allows compromised WiFi firmware to trigger host sk_buff use-after-free

[Devin Wittmayer]

On Mon, 12 Oct 2026 11:26:57 +0800, Eason Lai wrote:
> -	mt792xe_mcu_drv_pmctrl(dev);
> +	__mt792xe_mcu_drv_pmctrl(dev);
> +	clear_bit(MT76_STATE_PM, &mphy->state);

Eason,

A heads-up, since this one is on me: my d12a54be2604 in mt76 changed
the line this patch replaces, so it won't apply there or on
wireless-next as is. That commit makes the reset return early if the
driver can't take ownership back. If you want to keep that, it would
look something like:

	err = __mt792xe_mcu_drv_pmctrl(dev);
	if (err)
		return err;

	clear_bit(MT76_STATE_PM, &mphy->state);

Devin

Re: [PATCH] SER: mt7925: race condition in mt7925e_mac_reset allows compromised WiFi firmware to trigger host sk_buff use-after-free

[Eason Lai (賴易聖)]

On Mon, 2026-10-12 at 21:18 -0700, Devin Wittmayer wrote:
> 
> A heads-up, since this one is on me: my d12a54be2604 in mt76 changed
> the line this patch replaces, so it won't apply there or on
> wireless-next as is. That commit makes the reset return early if the
> driver can't take ownership back. If you want to keep that, it would
> look something like:
> 
>         err = __mt792xe_mcu_drv_pmctrl(dev);
>         if (err)
>                 return err;
> 
>         clear_bit(MT76_STATE_PM, &mphy->state);
> 
> Devin

Hi Devin,

Thanks for the heads-up.
v2 will be rebased and incorporate your suggested change. 

Thanks,
Eason