[PATCH] wifi: iwlegacy: unregister the LED if 3945 hardware registration fails

[PATCH] wifi: iwlegacy: unregister the LED if 3945 hardware registration fails

[Zhao Li]

If ieee80211_register_hw() fails during 3945 setup, later LED callbacks
can access hardware and driver state that probe has already freed.

il3945_setup_mac() registers the LED before the mac80211 hardware, but
its registration error path does not call il_leds_exit(). The analogous
4965 failure releases the driver and reaches its existing remove cleanup.

Unregister the 3945 LED before unwinding a failed hardware registration.

LLM assistance was used to find the bug and review.

Fixes: 5ed540aecc2a ("iwlwifi: use mac80211 throughput trigger")
Cc: stable@vger.kernel.org
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
---
Validation: A W=1 module build with MODPOST passed. Not
reproduced; 3945 hardware was unavailable.
Sparse C=2 passed. Targeted Smatch introduced no new diagnostics.

 drivers/net/wireless/intel/iwlegacy/3945-mac.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
index f7ca182d1494..5e11f0597255 100644
--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
@@ -3529,6 +3529,7 @@ il3945_setup_mac(struct il_priv *il)
 	ret = ieee80211_register_hw(il->hw);
 	if (ret) {
 		IL_ERR("Failed to register hw (error %d)\n", ret);
+		il_leds_exit(il);
 		return ret;
 	}
 	il->mac80211_registered = 1;

base-commit: 25e73f1d6868c759c8eb56cad4e411692c5341b4
-- 
2.56.0

Re: [PATCH] wifi: iwlegacy: unregister the LED if 3945 hardware registration fails

[Stanislaw Gruszka]

Hi,
On Wed, Oct 28, 2026 at 10:23:28PM +0800, Zhao Li wrote:
> If ieee80211_register_hw() fails during 3945 setup, later LED callbacks
> can access hardware and driver state that probe has already freed.
> 
> il3945_setup_mac() registers the LED before the mac80211 hardware, but
> its registration error path does not call il_leds_exit(). The analogous
> 4965 failure releases the driver and reaches its existing remove cleanup.

Could you explain exacly how this is fixed in 4965?
I do not see this in the code.

Regards
Stanislaw

> Unregister the 3945 LED before unwinding a failed hardware registration.
> 
> LLM assistance was used to find the bug and review.
> 
> Fixes: 5ed540aecc2a ("iwlwifi: use mac80211 throughput trigger")
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
> ---
> Validation: A W=1 module build with MODPOST passed. Not
> reproduced; 3945 hardware was unavailable.
> Sparse C=2 passed. Targeted Smatch introduced no new diagnostics.
> 
>  drivers/net/wireless/intel/iwlegacy/3945-mac.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
> index f7ca182d1494..5e11f0597255 100644
> --- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
> +++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
> @@ -3529,6 +3529,7 @@ il3945_setup_mac(struct il_priv *il)
>  	ret = ieee80211_register_hw(il->hw);
>  	if (ret) {
>  		IL_ERR("Failed to register hw (error %d)\n", ret);
> +		il_leds_exit(il);
>  		return ret;
>  	}
>  	il->mac80211_registered = 1;
> 
> base-commit: 25e73f1d6868c759c8eb56cad4e411692c5341b4
> -- 
> 2.56.0
> 

Re: [PATCH] wifi: iwlegacy: unregister the LED if 3945 hardware registration fails

[Zhao Li]

Hi Stanislaw,

On Thu, Oct 29, 2026 at 09:19:55AM +0100, Stanislaw Gruszka wrote:
> On Wed, Oct 28, 2026 at 10:23:28PM +0800, Zhao Li wrote:
> > il3945_setup_mac() registers the LED before the mac80211 hardware, but
> > its registration error path does not call il_leds_exit(). The analogous
> > 4965 failure releases the driver and reaches its existing remove cleanup.
>
> Could you explain exacly how this is fixed in 4965?
> I do not see this in the code.

There is no il_leds_exit() in the 4965 error path itself. The caller
handles it: il4965_mac_setup_register() runs from the firmware callback,
and a failure there unbinds the driver.

  il4965_ucode_callback()
    il4965_mac_setup_register()   /* il_leds_init(), register_hw fails */
    goto out_unbind
      complete(&il->_4965.firmware_loading_complete)
      device_release_driver(&il->pci_dev->dev)
        il4965_pci_remove()
          il_leds_exit(il)
          ...
          ieee80211_free_hw(il->hw)

il4965_pci_probe() returns success after submitting the asynchronous
firmware request. If the callback reaches device_release_driver()
before probe finishes, the device lock serializes unbind with probe.
The callback completes firmware_loading_complete before unbinding,
and il4965_pci_remove() unregisters the LED regardless of
mac80211_registered.

3945 calls il3945_setup_mac() directly from il3945_pci_probe(), and the
probe error labels never call il_leds_exit(). ieee80211_free_hw() then
frees the il_priv that embeds il->led while the LED is still on
leds_list, so the next led_trigger_register() takes the trigger_lock of
a freed LED.

That should have been in the changelog. I'll send a v2 that spells out
the 4965 path; the code change stays the same.

Thanks,
Zhao