[PATCH] SER: mt7925: race condition in mt7925e_mac_reset allows compromised WiFi firmware to trigger host sk_buff use-after-free

[Devin Wittmayer]

On Mon, 12 Oct 2026 11:26:57 +0800, Eason Lai wrote:
> -	mt792xe_mcu_drv_pmctrl(dev);
> +	__mt792xe_mcu_drv_pmctrl(dev);
> +	clear_bit(MT76_STATE_PM, &mphy->state);

Eason,

A heads-up, since this one is on me: my d12a54be2604 in mt76 changed
the line this patch replaces, so it won't apply there or on
wireless-next as is. That commit makes the reset return early if the
driver can't take ownership back. If you want to keep that, it would
look something like:

	err = __mt792xe_mcu_drv_pmctrl(dev);
	if (err)
		return err;

	clear_bit(MT76_STATE_PM, &mphy->state);

Devin