mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 07:03:28 -04:00
Code Issues Packages Projects Releases Wiki Activity

wifi: mt76: serialize scan-link teardown with dev->mutex

Browse Source 
The offchannel scan link is allocated in mt76_hw_scan() under
dev->mutex, but torn down without it: mt76_scan_complete() runs from
mt76_scan_work() on the mac80211 workqueue, or from mt76_abort_scan(),
and calls mt76_put_vif_phy_link(), whose vif_link_remove clears the
per-phy omac_mask and the device-wide vif_mask/mld_idx_mask with plain
read-modify-write. A vif link add or remove for another interface,
running concurrently under dev->mutex, can interleave with these
unlocked writes and lose an update: a cleared bit belonging to a live
link gets handed out again (two links sharing an omac/bss/wcid index,
breaking own-MAC unicast RX for the first one), or a freed bit stays
set until reboot and eventually exhausts the index space.

Take dev->mutex around the scan completion, mirroring the ROC teardown
in mt76_roc_complete_work()/mt76_abort_roc(), and switch the channel
restore to __mt76_set_channel() since the caller now holds the lock.
mt76_abort_scan() keeps cancelling the scan work before taking the
mutex, so the work-vs-abort ordering is unchanged.

Signed-off-by: Chad Monroe <chad@monroe.io>
Link: https://patch.msgid.link/20260724124813.3961474-28-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
This commit is contained in:
Chad Monroe
2026-07-24 12:48:12 +00:00
committed by Felix Fietkau
parent 6ff1c217a0
commit 4c3cf4a8b1
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/net/wireless/mediatek/mt76/scan.c
View File

@@ -11,6 +11,8 @@ static void mt76_scan_complete(struct mt76_dev *dev, bool abort)
.aborted = abort,
};
lockdep_assert_held(&dev->mutex);
if (!phy)
return;
@@ -24,7 +26,7 @@ static void mt76_scan_complete(struct mt76_dev *dev, bool abort)
!test_bit(MT76_MCU_RESET, &dev->phy.state)) {
bool offchannel = phy->offchannel;
mt76_set_channel(phy, &phy->main_chandef, false);
__mt76_set_channel(phy, &phy->main_chandef, false);
if (offchannel)
mt76_offchannel_notify(phy, false);
}
@@ -41,7 +43,10 @@ void mt76_abort_scan(struct mt76_dev *dev)
spin_unlock_bh(&dev->scan_lock);
cancel_delayed_work_sync(&dev->scan_work);
mutex_lock(&dev->mutex);
mt76_scan_complete(dev, true);
mutex_unlock(&dev->mutex);
}
EXPORT_SYMBOL_GPL(mt76_abort_scan);
@@ -139,7 +144,9 @@ void mt76_scan_work(struct work_struct *work)
goto probe;
if (dev->scan.chan_idx >= req->n_channels) {
mutex_lock(&dev->mutex);
mt76_scan_complete(dev, false);
mutex_unlock(&dev->mutex);
return;
}