diff options
| author | Felix Fietkau <nbd@nbd.name> | 2026-08-18 12:58:22 +0000 |
|---|---|---|
| committer | Felix Fietkau <nbd@nbd.name> | 2026-10-07 12:50:39 +0200 |
| commit | d6173b8b36e5cefc7cce34c31a0cc63fb3bd77f4 (patch) | |
| tree | 24da6ac228b0d863c3c8ff24b6c8470cebe6da2f /drivers | |
| parent | 00c3f77b0ca47d338b19b762f61e682e408b4c82 (diff) | |
wifi: mt76: check the owner of a remain-on-channel request
mvif->roc_phy points to the phy of the request that started last for the
interface. That request can end, and the phy can start a request for a
different interface. The driver does not always clear the pointer.
Two callers trust the pointer:
- mt76_vif_cleanup() aborts the request on that phy when the driver removes
the interface.
- mt76_cancel_remain_on_channel() aborts the request on that phy for the
interface.
If the phy holds a request for a different interface, both callers abort the
wrong request. The request of the interface stays active. Its work then runs
after the driver removes the interface. The work tears the link down through
the freed bss_conf.
Compare phy->roc_vif with the interface in both callers before the abort.
Fixes: a8f424c1287c ("wifi: mt76: add multi-radio remain_on_channel functions")
Link: https://patch.msgid.link/20260818125825.395538-2-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/wireless/mediatek/mt76/channel.c | 2 | ||||
| -rw-r--r-- | drivers/net/wireless/mediatek/mt76/mac80211.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/wireless/mediatek/mt76/channel.c b/drivers/net/wireless/mediatek/mt76/channel.c index 28ad7bcaffd4..1d2635672ac3 100644 --- a/drivers/net/wireless/mediatek/mt76/channel.c +++ b/drivers/net/wireless/mediatek/mt76/channel.c @@ -423,7 +423,7 @@ int mt76_cancel_remain_on_channel(struct ieee80211_hw *hw, struct mt76_vif_data *mvif = mlink->mvif; struct mt76_phy *phy = mvif->roc_phy; - if (!phy) + if (!phy || phy->roc_vif != vif) return 0; mt76_abort_roc(phy); diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c index cda5c5d51aab..9dd93f90de40 100644 --- a/drivers/net/wireless/mediatek/mt76/mac80211.c +++ b/drivers/net/wireless/mediatek/mt76/mac80211.c @@ -2110,7 +2110,7 @@ void mt76_vif_cleanup(struct mt76_dev *dev, struct ieee80211_vif *vif) rcu_assign_pointer(mvif->link[0], NULL); mt76_abort_scan(dev); - if (mvif->roc_phy) + if (mvif->roc_phy && mvif->roc_phy->roc_vif == vif) mt76_abort_roc(mvif->roc_phy); } EXPORT_SYMBOL_GPL(mt76_vif_cleanup); |