github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-28 00:53:34 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: mt76: fix list corruption in mt76_wcid_cleanup

Browse Source 
mt76_wcid_cleanup() was not removing wcid entries from sta_poll_list
before mt76_reset_device() reinitializes the master list. This leaves
stale pointers in wcid->poll_list, causing list corruption when
mt76_wcid_add_poll() later checks list_empty() and tries to add the
entry back.

The fix adds proper cleanup of poll_list in mt76_wcid_cleanup(),
matching how tx_list is already handled. This is similar to what
mt7996_mac_sta_deinit_link() already does correctly.

Fixes list corruption warnings like:
  list_add corruption. prev->next should be next (ffffffff...)

Signed-off-by: Zac Bowling <zac@zacbowling.com>
Link: https://patch.msgid.link/20260120201043.38225-3-zac@zacbowling.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
This commit is contained in:
Zac Bowling 2026-01-20 12:10:32 -08:00 committed by Felix Fietkau
parent ccb186326b
commit 3416394219
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/net/wireless/mediatek/mt76/mac80211.c
View File

@ -1716,6 +1716,16 @@ void mt76_wcid_cleanup(struct mt76_dev *dev, struct mt76_wcid *wcid)
idr_destroy(&wcid->pktid);
/* Remove from sta_poll_list to prevent list corruption after reset.
* Without this, mt76_reset_device() reinitializes sta_poll_list but
* leaves wcid->poll_list with stale pointers, causing list corruption
* when mt76_wcid_add_poll() checks list_empty().
*/
spin_lock_bh(&dev->sta_poll_lock);
if (!list_empty(&wcid->poll_list))
list_del_init(&wcid->poll_list);
spin_unlock_bh(&dev->sta_poll_lock);
spin_lock_bh(&phy->tx_lock);
if (!list_empty(&wcid->tx_list))