diff options
| author | Felix Fietkau <nbd@nbd.name> | 2026-07-24 12:48:01 +0000 |
|---|---|---|
| committer | Felix Fietkau <nbd@nbd.name> | 2026-08-01 14:49:42 +0000 |
| commit | 16a04441eab0dcd4d7126a6f66b370adbf28f96d (patch) | |
| tree | 87d9c14330eb83d56873a1237e9cecc19596155f | |
| parent | 490d81fd0cc1376ceb660ed2af602ad1bfe1ac77 (diff) | |
| download | linux-next-16a04441eab0dcd4d7126a6f66b370adbf28f96d.tar.gz linux-next-16a04441eab0dcd4d7126a6f66b370adbf28f96d.zip | |
wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
The flow is added to dev->twt_list before sending the agreement to the
firmware, but the error path leaves it linked while flowid_mask is
never set. The flow slot can then be reused and memset while still on
the list, corrupting twt_list, and station removal leaves a dangling
entry behind that mt7915_mac_twt_sched_list_add() later walks.
Fixes: 3782b69d03e7 ("mt76: mt7915: introduce mt7915_mac_add_twt_setup routine")
Link: https://patch.msgid.link/20260724124813.3961474-17-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
| -rw-r--r-- | drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c index 1154d3c4b811..ebe1376ffc2c 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c @@ -2350,8 +2350,10 @@ void mt7915_mac_add_twt_setup(struct ieee80211_hw *hw, } flow->tsf = le64_to_cpu(twt_agrt->twt); - if (mt7915_mcu_twt_agrt_update(dev, msta->vif, flow, MCU_TWT_AGRT_ADD)) + if (mt7915_mcu_twt_agrt_update(dev, msta->vif, flow, MCU_TWT_AGRT_ADD)) { + list_del(&flow->list); goto unlock; + } setup_cmd = TWT_SETUP_CMD_ACCEPT; dev->twt.table_mask |= BIT(table_id); |