2021-07-30 17:39:04

by Ben Greear

[permalink] [raw]
Subject: [PATCH v2] mt76: mt7915: Fix hwmon temp sensor mem use-after-free.

From: Ben Greear <[email protected]>

Without this change, garbage is seen in the hwmon name
and sensors output for mt7915 is garbled.

With the change:

mt7915-pci-1400
Adapter: PCI adapter
temp1: +49.0°C

Signed-off-by: Ben Greear <[email protected]>
---
v2: Take ext-phy into account
and do similar logic for the cooling device logic.

drivers/net/wireless/mediatek/mt76/mt7915/init.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
index 192e3e190ce1..944b74a807a7 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
@@ -132,8 +132,18 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
struct wiphy *wiphy = phy->mt76->hw->wiphy;
struct thermal_cooling_device *cdev;
struct device *hwmon;
-
- cdev = thermal_cooling_device_register(wiphy_name(wiphy), phy,
+ struct mt7915_dev *dev = phy->dev;
+ bool ext_phy = phy != &dev->phy;
+ static const char *prefix_ext = "mt7915_ext";
+ static const char *prefix = "mt7915";
+ const char *my_prefix;
+
+ if (ext_phy)
+ my_prefix = prefix_ext;
+ else
+ my_prefix = prefix;
+
+ cdev = thermal_cooling_device_register(my_prefix, phy,
&mt7915_thermal_ops);
if (!IS_ERR(cdev)) {
if (sysfs_create_link(&wiphy->dev.kobj, &cdev->device.kobj,
@@ -147,7 +157,7 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
return 0;

hwmon = devm_hwmon_device_register_with_groups(&wiphy->dev,
- wiphy_name(wiphy), phy,
+ my_prefix, phy,
mt7915_hwmon_groups);
if (IS_ERR(hwmon))
return PTR_ERR(hwmon);
--
2.20.1