Re: [PATCH wireless v2] wifi: iwlegacy: unregister the LED if 3945 hardware registration fails

[Stanislaw Gruszka]

On Thu, Oct 29, 2026 at 05:47:42PM +0800, Zhao Li wrote:
> If ieee80211_register_hw() fails during 3945 probe, the LED class device
> stays registered after probe frees the il_priv that embeds it. The next
> LED trigger registration, or a write to the LED's sysfs brightness file,
> then uses freed memory.
> 
> il3945_setup_mac() registers the LED before the mac80211 hardware, and
> il3945_pci_probe() unwinds a registration failure without calling
> il_leds_exit(). 4965 already performs this cleanup: when
> il4965_mac_setup_register() fails, il4965_ucode_callback() calls
> device_release_driver(), and il4965_pci_remove() then calls
> il_leds_exit().
> 
> Unregister the 3945 LED before unwinding a failed hardware registration.
> 
> LLM assistance was used to find the bug and review.
> 
> Fixes: 5ed540aecc2a ("iwlwifi: use mac80211 throughput trigger")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Zhao Li <enderaoelyther@xxxxxxxxx>
Acked-by: Stanislaw Gruszka <stf_xl@xxxxx>

> ---
> Changes in v2:
> - Explain how 4965 already performs this cleanup (Stanislaw)
> - Describe the use-after-free concretely
> - No code change
> 
> v1: https://lore.kernel.org/r/20261028142328.18560-1-enderaoelyther@xxxxxxxxx
> 
> Validation: A W=1 module build with MODPOST passed. Not
> reproduced; 3945 hardware was unavailable.
> Sparse C=2 passed. Targeted Smatch introduced no new diagnostics.
> 
>  drivers/net/wireless/intel/iwlegacy/3945-mac.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
> index f7ca182d1494..5e11f0597255 100644
> --- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
> +++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
> @@ -3529,6 +3529,7 @@ il3945_setup_mac(struct il_priv *il)
>  	ret = ieee80211_register_hw(il->hw);
>  	if (ret) {
>  		IL_ERR("Failed to register hw (error %d)\n", ret);
> +		il_leds_exit(il);
>  		return ret;
>  	}
>  	il->mac80211_registered = 1;
> 
> base-commit: 25e73f1d6868c759c8eb56cad4e411692c5341b4
> -- 
> 2.56.0
>