From 26e36bf38f1560c3243151138dee2efe2c80014e Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Tue, 18 Aug 2026 12:58:22 +0000 Subject: [PATCH] wifi: mt76: check the owner of a remain-on-channel request mvif->roc_phy points to the phy of the request that started last for the interface. That request can end, and the phy can start a request for a different interface. The driver does not always clear the pointer. Two callers trust the pointer: - mt76_vif_cleanup() aborts the request on that phy when the driver removes the interface. - mt76_cancel_remain_on_channel() aborts the request on that phy for the interface. If the phy holds a request for a different interface, both callers abort the wrong request. The request of the interface stays active. Its work then runs after the driver removes the interface. The work tears the link down through the freed bss_conf. Compare phy->roc_vif with the interface in both callers before the abort. Link: https://patch.msgid.link/20260818125825.395538-2-nbd@nbd.name Signed-off-by: Felix Fietkau --- channel.c | 2 +- mac80211.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/channel.c b/channel.c index 28ad7bca..1d263567 100644 --- a/channel.c +++ b/channel.c @@ -423,7 +423,7 @@ int mt76_cancel_remain_on_channel(struct ieee80211_hw *hw, struct mt76_vif_data *mvif = mlink->mvif; struct mt76_phy *phy = mvif->roc_phy; - if (!phy) + if (!phy || phy->roc_vif != vif) return 0; mt76_abort_roc(phy); diff --git a/mac80211.c b/mac80211.c index 3ab29b03..83c001a0 100644 --- a/mac80211.c +++ b/mac80211.c @@ -2099,7 +2099,7 @@ void mt76_vif_cleanup(struct mt76_dev *dev, struct ieee80211_vif *vif) rcu_assign_pointer(mvif->link[0], NULL); mt76_abort_scan(dev); - if (mvif->roc_phy) + if (mvif->roc_phy && mvif->roc_phy->roc_vif == vif) mt76_abort_roc(mvif->roc_phy); } EXPORT_SYMBOL_GPL(mt76_vif_cleanup);