Commit 0ae3ff56 authored by Ben Greear's avatar Ben Greear Committed by Felix Fietkau

mt76: mt7915: fix hwmon temp sensor mem use-after-free

Without this change, garbage is seen in the hwmon name and sensors output
for mt7915 is garbled. It appears that the hwmon logic does not make a
copy of the incoming string, but instead just copies a char* and expects
it to never go away.

Fixes: 33fe9c63 ("mt76: mt7915: add thermal sensor device support")
Signed-off-by: default avatarBen Greear <greearb@candelatech.com>
Signed-off-by: default avatarRyder Lee <ryder.lee@mediatek.com>
Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
parent 68ee6a14
...@@ -160,9 +160,12 @@ static int mt7915_thermal_init(struct mt7915_phy *phy) ...@@ -160,9 +160,12 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
struct wiphy *wiphy = phy->mt76->hw->wiphy; struct wiphy *wiphy = phy->mt76->hw->wiphy;
struct thermal_cooling_device *cdev; struct thermal_cooling_device *cdev;
struct device *hwmon; struct device *hwmon;
const char *name;
cdev = thermal_cooling_device_register(wiphy_name(wiphy), phy, name = devm_kasprintf(&wiphy->dev, GFP_KERNEL, "mt7915_%s",
&mt7915_thermal_ops); wiphy_name(wiphy));
cdev = thermal_cooling_device_register(name, phy, &mt7915_thermal_ops);
if (!IS_ERR(cdev)) { if (!IS_ERR(cdev)) {
if (sysfs_create_link(&wiphy->dev.kobj, &cdev->device.kobj, if (sysfs_create_link(&wiphy->dev.kobj, &cdev->device.kobj,
"cooling_device") < 0) "cooling_device") < 0)
...@@ -174,8 +177,7 @@ static int mt7915_thermal_init(struct mt7915_phy *phy) ...@@ -174,8 +177,7 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
if (!IS_REACHABLE(CONFIG_HWMON)) if (!IS_REACHABLE(CONFIG_HWMON))
return 0; return 0;
hwmon = devm_hwmon_device_register_with_groups(&wiphy->dev, hwmon = devm_hwmon_device_register_with_groups(&wiphy->dev, name, phy,
wiphy_name(wiphy), phy,
mt7915_hwmon_groups); mt7915_hwmon_groups);
if (IS_ERR(hwmon)) if (IS_ERR(hwmon))
return PTR_ERR(hwmon); return PTR_ERR(hwmon);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment