[PATCH wireless v2] wifi: iwlegacy: unregister the LED if 3945 hardware registration fails

[PATCH wireless v2] wifi: iwlegacy: unregister the LED if 3945 hardware registration fails

[Zhao Li]

If ieee80211_register_hw() fails during 3945 probe, the LED class device
stays registered after probe frees the il_priv that embeds it. The next
LED trigger registration, or a write to the LED's sysfs brightness file,
then uses freed memory.

il3945_setup_mac() registers the LED before the mac80211 hardware, and
il3945_pci_probe() unwinds a registration failure without calling
il_leds_exit(). 4965 already performs this cleanup: when
il4965_mac_setup_register() fails, il4965_ucode_callback() calls
device_release_driver(), and il4965_pci_remove() then calls
il_leds_exit().

Unregister the 3945 LED before unwinding a failed hardware registration.

LLM assistance was used to find the bug and review.

Fixes: 5ed540aecc2a ("iwlwifi: use mac80211 throughput trigger")
Cc: stable@vger.kernel.org
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
---
Changes in v2:
- Explain how 4965 already performs this cleanup (Stanislaw)
- Describe the use-after-free concretely
- No code change

v1: https://lore.kernel.org/r/20261028142328.18560-1-enderaoelyther@gmail.com

Validation: A W=1 module build with MODPOST passed. Not
reproduced; 3945 hardware was unavailable.
Sparse C=2 passed. Targeted Smatch introduced no new diagnostics.

 drivers/net/wireless/intel/iwlegacy/3945-mac.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
index f7ca182d1494..5e11f0597255 100644
--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
@@ -3529,6 +3529,7 @@ il3945_setup_mac(struct il_priv *il)
 	ret = ieee80211_register_hw(il->hw);
 	if (ret) {
 		IL_ERR("Failed to register hw (error %d)\n", ret);
+		il_leds_exit(il);
 		return ret;
 	}
 	il->mac80211_registered = 1;

base-commit: 25e73f1d6868c759c8eb56cad4e411692c5341b4
-- 
2.56.0

Re: [PATCH wireless v2] wifi: iwlegacy: unregister the LED if 3945 hardware registration fails

[Stanislaw Gruszka]

On Thu, Oct 29, 2026 at 05:47:42PM +0800, Zhao Li wrote:
> If ieee80211_register_hw() fails during 3945 probe, the LED class device
> stays registered after probe frees the il_priv that embeds it. The next
> LED trigger registration, or a write to the LED's sysfs brightness file,
> then uses freed memory.
> 
> il3945_setup_mac() registers the LED before the mac80211 hardware, and
> il3945_pci_probe() unwinds a registration failure without calling
> il_leds_exit(). 4965 already performs this cleanup: when
> il4965_mac_setup_register() fails, il4965_ucode_callback() calls
> device_release_driver(), and il4965_pci_remove() then calls
> il_leds_exit().
> 
> Unregister the 3945 LED before unwinding a failed hardware registration.
> 
> LLM assistance was used to find the bug and review.
> 
> Fixes: 5ed540aecc2a ("iwlwifi: use mac80211 throughput trigger")
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>

> ---
> Changes in v2:
> - Explain how 4965 already performs this cleanup (Stanislaw)
> - Describe the use-after-free concretely
> - No code change
> 
> v1: https://lore.kernel.org/r/20261028142328.18560-1-enderaoelyther@gmail.com
> 
> Validation: A W=1 module build with MODPOST passed. Not
> reproduced; 3945 hardware was unavailable.
> Sparse C=2 passed. Targeted Smatch introduced no new diagnostics.
> 
>  drivers/net/wireless/intel/iwlegacy/3945-mac.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
> index f7ca182d1494..5e11f0597255 100644
> --- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
> +++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
> @@ -3529,6 +3529,7 @@ il3945_setup_mac(struct il_priv *il)
>  	ret = ieee80211_register_hw(il->hw);
>  	if (ret) {
>  		IL_ERR("Failed to register hw (error %d)\n", ret);
> +		il_leds_exit(il);
>  		return ret;
>  	}
>  	il->mac80211_registered = 1;
> 
> base-commit: 25e73f1d6868c759c8eb56cad4e411692c5341b4
> -- 
> 2.56.0
>