wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work

The mt7921_set_roc API may be executed concurrently with mt7921_roc_work,
specifically between the following code paths:

- The check and clear of MT76_STATE_ROC in mt7921_roc_work:
    if (!test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state))
        return;

- The execution of ieee80211_iterate_active_interfaces.

This race condition can interrupt the ROC abort flow, resulting in
the ROC process failing to abort as expected.

To address this defect, the modification of MT76_STATE_ROC is now
protected by mt792x_mutex_acquire(phy->dev). This ensures that
changes to the ROC state are properly synchronized, preventing
race conditions and ensuring the ROC abort flow is not interrupted.

Fixes: 034ae28b56f1 ("wifi: mt76: mt7921: introduce remain_on_channel support")
Cc: [email protected]
Signed-off-by: Quan Zhou <[email protected]>
Reviewed-by: Sean Wang <[email protected]>
Link: https://patch.msgid.link/2568ece8b557e5dda79391414c834ef3233049b6.1769133724.git.quan.zhou@mediatek.com
Signed-off-by: Felix Fietkau <[email protected]>
This commit is contained in:
Quan Zhou
2026-01-27 12:10:38 +00:00
committed by Felix Fietkau
parent 4b0df538fb
commit 7595227241
+4 -3
View File
@@ -387,10 +387,11 @@ void mt7921_roc_work(struct work_struct *work)
phy = (struct mt792x_phy *)container_of(work, struct mt792x_phy,
roc_work);
if (!test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state))
return;
mt792x_mutex_acquire(phy->dev);
if (!test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state)) {
mt792x_mutex_release(phy->dev);
return;
}
ieee80211_iterate_active_interfaces(phy->mt76->hw,
IEEE80211_IFACE_ITER_RESUME_ALL,
mt7921_roc_iter, phy);