From: Charlie-cy Wu mt76_mcu_skb_send_and_get_msg() can return -EIO on an SDIO bus hang before *ret_skb is cleared, and mt76_mcu_send_and_get_msg() returns from the mcu_send_msg and -ENOMEM paths without touching *ret_skb. Callers such as mt7925_mcu_get_nic_capability(), mt7925_mcu_chip_config_query() and mt7921_mcu_get_nic_capability() are then left with an uninitialized skb pointer. Clear *ret_skb at the top of both helpers so that every return path leaves it initialized. Signed-off-by: Charlie-cy Wu --- drivers/net/wireless/mediatek/mt76/mcu.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/mediatek/mt76/mcu.c b/drivers/net/wireless/mediatek/mt76/mcu.c index 54b2ef2d5916..d8821dc89247 100644 --- a/drivers/net/wireless/mediatek/mt76/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mcu.c @@ -58,6 +58,9 @@ int mt76_mcu_send_and_get_msg(struct mt76_dev *dev, int cmd, const void *data, { struct sk_buff *skb; + if (ret_skb) + *ret_skb = NULL; + if (dev->mcu_ops->mcu_send_msg) return dev->mcu_ops->mcu_send_msg(dev, cmd, data, len, wait_resp); @@ -78,15 +81,15 @@ int mt76_mcu_skb_send_and_get_msg(struct mt76_dev *dev, struct sk_buff *skb, unsigned long expires; int ret, seq; + if (ret_skb) + *ret_skb = NULL; + if (mt76_is_sdio(dev)) if (test_bit(MT76_RESET, &dev->phy.state) && atomic_read(&dev->bus_hung)) { dev_kfree_skb(skb); return -EIO; } - if (ret_skb) - *ret_skb = NULL; - mutex_lock(&dev->mcu.mutex); if (dev->mcu_ops->mcu_skb_prepare_msg) { -- 2.18.0