[PATCH wireless v2] wifi: iwlegacy: unregister the LED if 3945 hardware registration fails

[Zhao Li]

If ieee80211_register_hw() fails during 3945 probe, the LED class device
stays registered after probe frees the il_priv that embeds it. The next
LED trigger registration, or a write to the LED's sysfs brightness file,
then uses freed memory.

il3945_setup_mac() registers the LED before the mac80211 hardware, and
il3945_pci_probe() unwinds a registration failure without calling
il_leds_exit(). 4965 already performs this cleanup: when
il4965_mac_setup_register() fails, il4965_ucode_callback() calls
device_release_driver(), and il4965_pci_remove() then calls
il_leds_exit().

Unregister the 3945 LED before unwinding a failed hardware registration.

LLM assistance was used to find the bug and review.

Fixes: 5ed540aecc2a ("iwlwifi: use mac80211 throughput trigger")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Zhao Li <enderaoelyther@xxxxxxxxx>
---
Changes in v2:
- Explain how 4965 already performs this cleanup (Stanislaw)
- Describe the use-after-free concretely
- No code change

v1: https://lore.kernel.org/r/20261028142328.18560-1-enderaoelyther@xxxxxxxxx

Validation: A W=1 module build with MODPOST passed. Not
reproduced; 3945 hardware was unavailable.
Sparse C=2 passed. Targeted Smatch introduced no new diagnostics.

 drivers/net/wireless/intel/iwlegacy/3945-mac.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
index f7ca182d1494..5e11f0597255 100644
--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
@@ -3529,6 +3529,7 @@ il3945_setup_mac(struct il_priv *il)
 	ret = ieee80211_register_hw(il->hw);
 	if (ret) {
 		IL_ERR("Failed to register hw (error %d)\n", ret);
+		il_leds_exit(il);
 		return ret;
 	}
 	il->mac80211_registered = 1;

base-commit: 25e73f1d6868c759c8eb56cad4e411692c5341b4
-- 
2.56.0