* [PATCH wireless] wifi: mt76: do not run mt76_unregister_device() on unregistered hw
@ 2023-02-22 23:10 Lorenzo Bianconi
2023-02-23 8:46 ` Lorenzo Bianconi
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Lorenzo Bianconi @ 2023-02-22 23:10 UTC (permalink / raw)
To: linux-wireless; +Cc: nbd, helmut, lorenzo.bianconi
Trying to probe a mt7921e pci card without firmware results in a
successful probe where ieee80211_register_hw hasn't been called. When
removing the driver, ieee802111_unregister_hw is called unconditionally
leading to a kernel NULL pointer dereference.
Fix the issue running mt76_unregister_device routine just for registered
hw.
Link: https://bugs.debian.org/1029116
Link: https://bugs.kali.org/view.php?id=8140
Reported-by: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
Fixes: 1c71e03afe4b ("mt76: mt7921: move mt7921_init_hw in a dedicated work")
Tested-by: Helmut Grohne <helmut@freexian.com>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mac80211.c | 8 ++++++++
drivers/net/wireless/mediatek/mt76/mt76.h | 1 +
2 files changed, 9 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index b117e4467c87..34abf70f44af 100644
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -539,6 +539,7 @@ int mt76_register_phy(struct mt76_phy *phy, bool vht,
if (ret)
return ret;
+ set_bit(MT76_STATE_REGISTERED, &phy->state);
phy->dev->phys[phy->band_idx] = phy;
return 0;
@@ -549,6 +550,9 @@ void mt76_unregister_phy(struct mt76_phy *phy)
{
struct mt76_dev *dev = phy->dev;
+ if (!test_bit(MT76_STATE_REGISTERED, &phy->state))
+ return;
+
if (IS_ENABLED(CONFIG_MT76_LEDS))
mt76_led_cleanup(phy);
mt76_tx_status_check(dev, true);
@@ -719,6 +723,7 @@ int mt76_register_device(struct mt76_dev *dev, bool vht,
return ret;
WARN_ON(mt76_worker_setup(hw, &dev->tx_worker, NULL, "tx"));
+ set_bit(MT76_STATE_REGISTERED, &phy->state);
sched_set_fifo_low(dev->tx_worker.task);
return 0;
@@ -729,6 +734,9 @@ void mt76_unregister_device(struct mt76_dev *dev)
{
struct ieee80211_hw *hw = dev->hw;
+ if (!test_bit(MT76_STATE_REGISTERED, &dev->phy.state))
+ return;
+
if (IS_ENABLED(CONFIG_MT76_LEDS))
mt76_led_cleanup(&dev->phy);
mt76_tx_status_check(dev, true);
diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
index ccca0162c8f8..183b0fc5a2d4 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76.h
@@ -402,6 +402,7 @@ struct mt76_tx_cb {
enum {
MT76_STATE_INITIALIZED,
+ MT76_STATE_REGISTERED,
MT76_STATE_RUNNING,
MT76_STATE_MCU_RUNNING,
MT76_SCANNING,
--
2.39.2
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH wireless] wifi: mt76: do not run mt76_unregister_device() on unregistered hw
2023-02-22 23:10 [PATCH wireless] wifi: mt76: do not run mt76_unregister_device() on unregistered hw Lorenzo Bianconi
@ 2023-02-23 8:46 ` Lorenzo Bianconi
2023-02-24 16:42 ` Kalle Valo
2023-03-13 13:30 ` Kalle Valo
2 siblings, 0 replies; 4+ messages in thread
From: Lorenzo Bianconi @ 2023-02-23 8:46 UTC (permalink / raw)
To: linux-wireless; +Cc: nbd, helmut, lorenzo.bianconi
[-- Attachment #1: Type: text/plain, Size: 2965 bytes --]
> Trying to probe a mt7921e pci card without firmware results in a
> successful probe where ieee80211_register_hw hasn't been called. When
> removing the driver, ieee802111_unregister_hw is called unconditionally
> leading to a kernel NULL pointer dereference.
> Fix the issue running mt76_unregister_device routine just for registered
> hw.
Reviewing the code better, mt7921 is the only driver registering ieee80211_hw in
init work. I do not have a strong opinion if it is better this approach or the
fix posted by Helmut, I am fine both ways.
@Felix: what do you think?
Regards,
Lorenzo
>
> Link: https://bugs.debian.org/1029116
> Link: https://bugs.kali.org/view.php?id=8140
> Reported-by: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
> Fixes: 1c71e03afe4b ("mt76: mt7921: move mt7921_init_hw in a dedicated work")
> Tested-by: Helmut Grohne <helmut@freexian.com>
> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
> ---
> drivers/net/wireless/mediatek/mt76/mac80211.c | 8 ++++++++
> drivers/net/wireless/mediatek/mt76/mt76.h | 1 +
> 2 files changed, 9 insertions(+)
>
> diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
> index b117e4467c87..34abf70f44af 100644
> --- a/drivers/net/wireless/mediatek/mt76/mac80211.c
> +++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
> @@ -539,6 +539,7 @@ int mt76_register_phy(struct mt76_phy *phy, bool vht,
> if (ret)
> return ret;
>
> + set_bit(MT76_STATE_REGISTERED, &phy->state);
> phy->dev->phys[phy->band_idx] = phy;
>
> return 0;
> @@ -549,6 +550,9 @@ void mt76_unregister_phy(struct mt76_phy *phy)
> {
> struct mt76_dev *dev = phy->dev;
>
> + if (!test_bit(MT76_STATE_REGISTERED, &phy->state))
> + return;
> +
> if (IS_ENABLED(CONFIG_MT76_LEDS))
> mt76_led_cleanup(phy);
> mt76_tx_status_check(dev, true);
> @@ -719,6 +723,7 @@ int mt76_register_device(struct mt76_dev *dev, bool vht,
> return ret;
>
> WARN_ON(mt76_worker_setup(hw, &dev->tx_worker, NULL, "tx"));
> + set_bit(MT76_STATE_REGISTERED, &phy->state);
> sched_set_fifo_low(dev->tx_worker.task);
>
> return 0;
> @@ -729,6 +734,9 @@ void mt76_unregister_device(struct mt76_dev *dev)
> {
> struct ieee80211_hw *hw = dev->hw;
>
> + if (!test_bit(MT76_STATE_REGISTERED, &dev->phy.state))
> + return;
> +
> if (IS_ENABLED(CONFIG_MT76_LEDS))
> mt76_led_cleanup(&dev->phy);
> mt76_tx_status_check(dev, true);
> diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
> index ccca0162c8f8..183b0fc5a2d4 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt76.h
> +++ b/drivers/net/wireless/mediatek/mt76/mt76.h
> @@ -402,6 +402,7 @@ struct mt76_tx_cb {
>
> enum {
> MT76_STATE_INITIALIZED,
> + MT76_STATE_REGISTERED,
> MT76_STATE_RUNNING,
> MT76_STATE_MCU_RUNNING,
> MT76_SCANNING,
> --
> 2.39.2
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH wireless] wifi: mt76: do not run mt76_unregister_device() on unregistered hw
2023-02-22 23:10 [PATCH wireless] wifi: mt76: do not run mt76_unregister_device() on unregistered hw Lorenzo Bianconi
2023-02-23 8:46 ` Lorenzo Bianconi
@ 2023-02-24 16:42 ` Kalle Valo
2023-03-13 13:30 ` Kalle Valo
2 siblings, 0 replies; 4+ messages in thread
From: Kalle Valo @ 2023-02-24 16:42 UTC (permalink / raw)
To: Lorenzo Bianconi; +Cc: linux-wireless, nbd, helmut, lorenzo.bianconi
Lorenzo Bianconi <lorenzo@kernel.org> writes:
> Trying to probe a mt7921e pci card without firmware results in a
> successful probe where ieee80211_register_hw hasn't been called. When
> removing the driver, ieee802111_unregister_hw is called unconditionally
> leading to a kernel NULL pointer dereference.
> Fix the issue running mt76_unregister_device routine just for registered
> hw.
>
> Link: https://bugs.debian.org/1029116
> Link: https://bugs.kali.org/view.php?id=8140
> Reported-by: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
> Fixes: 1c71e03afe4b ("mt76: mt7921: move mt7921_init_hw in a dedicated work")
> Tested-by: Helmut Grohne <helmut@freexian.com>
> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
I assigned this to myself on patchwork and will queue for v6.3.
--
https://patchwork.kernel.org/project/linux-wireless/list/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH wireless] wifi: mt76: do not run mt76_unregister_device() on unregistered hw
2023-02-22 23:10 [PATCH wireless] wifi: mt76: do not run mt76_unregister_device() on unregistered hw Lorenzo Bianconi
2023-02-23 8:46 ` Lorenzo Bianconi
2023-02-24 16:42 ` Kalle Valo
@ 2023-03-13 13:30 ` Kalle Valo
2 siblings, 0 replies; 4+ messages in thread
From: Kalle Valo @ 2023-03-13 13:30 UTC (permalink / raw)
To: Lorenzo Bianconi; +Cc: linux-wireless, nbd, helmut, lorenzo.bianconi
Lorenzo Bianconi <lorenzo@kernel.org> wrote:
> Trying to probe a mt7921e pci card without firmware results in a
> successful probe where ieee80211_register_hw hasn't been called. When
> removing the driver, ieee802111_unregister_hw is called unconditionally
> leading to a kernel NULL pointer dereference.
> Fix the issue running mt76_unregister_device routine just for registered
> hw.
>
> Link: https://bugs.debian.org/1029116
> Link: https://bugs.kali.org/view.php?id=8140
> Reported-by: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
> Fixes: 1c71e03afe4b ("mt76: mt7921: move mt7921_init_hw in a dedicated work")
> Tested-by: Helmut Grohne <helmut@freexian.com>
> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Patch applied to wireless.git, thanks.
41130c32f3a1 wifi: mt76: do not run mt76_unregister_device() on unregistered hw
--
https://patchwork.kernel.org/project/linux-wireless/patch/be3457d82f4e44bb71a22b2b5db27b644a37b1e1.1677107277.git.lorenzo@kernel.org/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-03-13 13:31 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-02-22 23:10 [PATCH wireless] wifi: mt76: do not run mt76_unregister_device() on unregistered hw Lorenzo Bianconi
2023-02-23 8:46 ` Lorenzo Bianconi
2023-02-24 16:42 ` Kalle Valo
2023-03-13 13:30 ` Kalle Valo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).