diff options
| author | Felix Fietkau <nbd@nbd.name> | 2026-07-02 15:21:12 +0000 |
|---|---|---|
| committer | Felix Fietkau <nbd@nbd.name> | 2026-10-07 12:50:40 +0200 |
| commit | b8286bc7fe520e7117e7b6e1a1fd4c0df439aa3a (patch) | |
| tree | 62f0d48591258ece2ac623f29b7d9ef897001977 | |
| parent | c88f880c6430948492a4eee00d90e48fa800febf (diff) | |
wifi: mt76: mt7915: unregister thermal cooling device on hwmon failure
mt7915_thermal_init() registered the thermal cooling device and its sysfs
link, then returned the hwmon registration error without undoing them.
The cooling device (not devm-managed) and the link then leaked, and its
callbacks referenced the freed phy. Unregister the cooling device before
returning the error.
Fixes: 0ae3ff568451 ("mt76: mt7915: fix hwmon temp sensor mem use-after-free")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
| -rw-r--r-- | drivers/net/wireless/mediatek/mt76/mt7915/init.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c index ca46a203aa48..aeefd323c10e 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c @@ -248,7 +248,12 @@ static int mt7915_thermal_init(struct mt7915_phy *phy) hwmon = devm_hwmon_device_register_with_groups(&wiphy->dev, name, phy, mt7915_hwmon_groups); - return PTR_ERR_OR_ZERO(hwmon); + if (IS_ERR(hwmon)) { + mt7915_unregister_thermal(phy); + return PTR_ERR(hwmon); + } + + return 0; } static void mt7915_led_set_config(struct led_classdev *led_cdev, |