github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-28 17:13:52 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: mt76: fix deadlock in remain-on-channel

Browse Source 
mt76_remain_on_channel() and mt76_roc_complete() call mt76_set_channel()
while already holding dev->mutex. Since mt76_set_channel() also acquires
dev->mutex, this results in a deadlock.

Use __mt76_set_channel() instead of mt76_set_channel().
Add cancel_delayed_work_sync() for mac_work before acquiring the mutex
in mt76_remain_on_channel() to prevent a secondary deadlock with the
mac_work workqueue.

Fixes: a8f424c128 ("wifi: mt76: add multi-radio remain_on_channel functions")
Signed-off-by: Chad Monroe <chad@monroe.io>
Link: https://patch.msgid.link/ace737e7b621af7c2adb33b0188011a5c1de2166.1765204256.git.chad@monroe.io
Signed-off-by: Felix Fietkau <nbd@nbd.name>
This commit is contained in:
Chad Monroe 2025-12-08 14:31:32 +00:00 committed by Felix Fietkau
parent d5059e52fd
commit 6939b97dda
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/net/wireless/mediatek/mt76/channel.c
View File

@ -326,7 +326,7 @@ void mt76_roc_complete(struct mt76_phy *phy)
mlink->mvif->roc_phy = NULL;
if (phy->main_chandef.chan &&
!test_bit(MT76_MCU_RESET, &dev->phy.state))
mt76_set_channel(phy, &phy->main_chandef, false);
__mt76_set_channel(phy, &phy->main_chandef, false);
mt76_put_vif_phy_link(phy, phy->roc_vif, phy->roc_link);
phy->roc_vif = NULL;
phy->roc_link = NULL;
@ -370,6 +370,8 @@ int mt76_remain_on_channel(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
if (!phy)
return -EINVAL;
cancel_delayed_work_sync(&phy->mac_work);
mutex_lock(&dev->mutex);
if (phy->roc_vif || dev->scan.phy == phy ||
@ -388,7 +390,14 @@ int mt76_remain_on_channel(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
phy->roc_vif = vif;
phy->roc_link = mlink;
cfg80211_chandef_create(&chandef, chan, NL80211_CHAN_HT20);
mt76_set_channel(phy, &chandef, true);
ret = __mt76_set_channel(phy, &chandef, true);
if (ret) {
mlink->mvif->roc_phy = NULL;
phy->roc_vif = NULL;
phy->roc_link = NULL;
mt76_put_vif_phy_link(phy, vif, mlink);
goto out;
}
ieee80211_ready_on_channel(hw);
ieee80211_queue_delayed_work(phy->hw, &phy->roc_work,
msecs_to_jiffies(duration));