[PATCH] SER: mt7925: race condition in mt7925e_mac_reset allows compromised WiFi firmware to trigger host sk_buff use-after-free

[Eason Lai]

From: Jeff Hsu <Jeff.Hsu at mediatek.com>

Fix racing condition in reset handler result sk_buff use-after-free

Signed-off-by: Jeff Hsu <Jeff.Hsu at mediatek.com>
---
 drivers/net/wireless/mediatek/mt76/mt7925/pci_mac.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/pci_mac.c b/drivers/net/wireless/mediatek/mt76/mt7925/pci_mac.c
index c3db814b2788..555eeb74d023 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/pci_mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/pci_mac.c
@@ -73,9 +73,11 @@ void mt7925_tx_token_put(struct mt792x_dev *dev)
 int mt7925e_mac_reset(struct mt792x_dev *dev)
 {
 	const struct mt792x_irq_map *irq_map = dev->irq_map;
+	struct mt76_phy *mphy = &dev->mt76.phy;
 	int i, err;
 
-	mt792xe_mcu_drv_pmctrl(dev);
+	__mt792xe_mcu_drv_pmctrl(dev);
+	clear_bit(MT76_STATE_PM, &mphy->state);
 
 	mt76_connac_free_pending_tx_skbs(&dev->pm, NULL);
 
-- 
2.45.2