[PATCH v2] wifi: mt76: mt7925: race condition in mt7925e_mac_reset allows compromised WiFi firmware to trigger host sk_buff use-after-free

[Eason Lai]

From: Jeff Hsu <Jeff.Hsu at mediatek.com>

Fix racing condition in reset handler result sk_buff use-after-free

Signed-off-by: Jeff Hsu <Jeff.Hsu at mediatek.com>
---
v2: Rebase the code, due to code conflict with previous change in d12a54be2604
---
 drivers/net/wireless/mediatek/mt76/mt7925/pci_mac.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/pci_mac.c b/drivers/net/wireless/mediatek/mt76/mt7925/pci_mac.c
index 18f125bf3df4..bc8f741e9426 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/pci_mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/pci_mac.c
@@ -71,12 +71,15 @@ void mt7925_tx_token_put(struct mt792x_dev *dev)
 int mt7925e_mac_reset(struct mt792x_dev *dev)
 {
 	const struct mt792x_irq_map *irq_map = dev->irq_map;
+	struct mt76_phy *mphy = &dev->mt76.phy;
 	int i, err;
 
-	err = mt792xe_mcu_drv_pmctrl(dev);
+	err = __mt792xe_mcu_drv_pmctrl(dev);
 	if (err)
 		return err;
 
+	clear_bit(MT76_STATE_PM, &mphy->state);
+
 	mt76_connac_free_pending_tx_skbs(&dev->pm, NULL);
 
 	mt76_wr(dev, dev->irq_map->host_irq_enable, 0);
-- 
2.45.2