wifi: mt76: mt7925e: fix use-after-free in free_irq()

From commit a304e1b82808 ("[PATCH] Debug shared irqs"), there is a test
to make sure the shared irq handler should be able to handle the unexpected
event after deregistration. For this case, let's apply MT76_REMOVED flag to
indicate the device was removed and do not run into the resource access
anymore.

Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
Signed-off-by: Deren Wu <deren.wu@mediatek.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/pci.c b/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
index 74cfba7675beb78f787ea9ff10cb917ea73d061a..07b74d492ce15c7ab6538f3a63d8d4913acb1a34 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
@@ -427,6 +427,7 @@ static void mt7925_pci_remove(struct pci_dev *pdev)
        struct mt792x_dev *dev = container_of(mdev, struct mt792x_dev, mt76);
 
        mt7925e_unregister_device(dev);
+       set_bit(MT76_REMOVED, &mdev->phy.state);
        devm_free_irq(&pdev->dev, pdev->irq, dev);
        mt76_free_device(&dev->mt76);
        pci_free_irq_vectors(pdev);