diff options
| author | Felix Fietkau <nbd@nbd.name> | 2026-07-24 12:48:09 +0000 |
|---|---|---|
| committer | Felix Fietkau <nbd@nbd.name> | 2026-08-01 14:49:42 +0000 |
| commit | 7e4208e9f6a876c2b7d28fdb6b86dff3b05db2f7 (patch) | |
| tree | f98028413199d7a8525b3b2529c461a1a28cf27a | |
| parent | 496ea8ceb2113d0fdeb1b37437d3a4d282162b2f (diff) | |
| download | linux-7e4208e9f6a876c2b7d28fdb6b86dff3b05db2f7.tar.gz linux-7e4208e9f6a876c2b7d28fdb6b86dff3b05db2f7.zip | |
wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset
mt7996_mac_reset_vif_iter() queues non-default vif links for kfree_rcu
while dev->wcid[] still holds pointers to the wcid embedded in each
freed link; mt76_reset_device() then dereferences those entries and
runs mt76_wcid_cleanup() on them. If a grace period elapses in between,
the cleanup operates on freed memory.
Run mt76_reset_device() first, so the wcid entries are cleaned up and
cleared while the links are still valid.
Fixes: ace5d3b6b49e ("wifi: mt76: mt7996: improve hardware restart reliability")
Link: https://patch.msgid.link/20260724124813.3961474-25-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
| -rw-r--r-- | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c index 544da01b0411..ce8c5a5ea8cc 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c @@ -2485,10 +2485,10 @@ mt7996_mac_full_reset(struct mt7996_dev *dev) phy->omac_mask = 0; ieee80211_iterate_stations_atomic(hw, mt7996_mac_reset_sta_iter, dev); + mt76_reset_device(&dev->mt76); ieee80211_iterate_active_interfaces_atomic(hw, IEEE80211_IFACE_SKIP_SDATA_NOT_IN_DRIVER, mt7996_mac_reset_vif_iter, dev); - mt76_reset_device(&dev->mt76); INIT_LIST_HEAD(&dev->sta_rc_list); INIT_LIST_HEAD(&dev->twt_list); |