wifi: mt76: mt7925e: fix use-after-free in free_irq()

jira LE-1907
cve CVE-2024-27049
Rebuild_History Non-Buildable kernel-5.14.0-427.31.1.el9_4
commit-author Deren Wu <deren.wu@mediatek.com>
commit a5a5f44

From commit a304e1b ("[PATCH] Debug shared irqs"), there is a test
to make sure the shared irq handler should be able to handle the unexpected
event after deregistration. For this case, let's apply MT76_REMOVED flag to
indicate the device was removed and do not run into the resource access
anymore.

Fixes: c948b5d ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
	Signed-off-by: Deren Wu <deren.wu@mediatek.com>
	Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit a5a5f44)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>

Author: PlaidCat

drivers/net/wireless/mediatek/mt76/mt7925/pci.c

@@ -425,6 +425,7 @@ static void mt7925_pci_remove(struct pci_dev *pdev)
 	struct mt792x_dev *dev = container_of(mdev, struct mt792x_dev, mt76);
 
 	mt7925e_unregister_device(dev);
+	set_bit(MT76_REMOVED, &mdev->phy.state);
 	devm_free_irq(&pdev->dev, pdev->irq, dev);
 	mt76_free_device(&dev->mt76);
 	pci_free_irq_vectors(pdev);