From d73f61254a7957466831cf5b8b10afefca7144ae Mon Sep 17 00:00:00 2001 From: Zhao Li Date: Tue, 25 Aug 2026 19:26:20 +0800 Subject: [PATCH] wifi: mt76: mt7996: unlink TWT flow if the MCU rejects the agreement mt7996_mac_add_twt_setup() links a new flow into dev->twt_list before asking the MCU to add the agreement, but exits without unlinking the flow if the request fails. The flow-ID and table masks are only committed after MCU success, so the still-linked flow is invisible to the mask-gated teardown paths. If the station retries the setup, the same slot is cleared and its embedded list node reinitialized while it is still linked, corrupting dev->twt_list. If the station disassociates instead, teardown skips the flow and station storage can be freed while the node remains linked. A later scheduling or debugfs twt_stats walk can then dereference the freed flow, resulting in a use-after-free. Unlink the flow when the MCU rejects the agreement. This restores the list to its pre-request state while leaving the unchanged mask and agreement accounting untouched. Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20260729173632.14387-3-enderaoelyther@gmail.com/ Assisted-by: Codex:gpt-5.6-sol Assisted-by: Kimi:K3 Signed-off-by: Zhao Li Link: https://patch.msgid.link/20260825112620.97568-1-enderaoelyther@gmail.com Signed-off-by: Felix Fietkau --- mt7996/mac.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/mt7996/mac.c b/mt7996/mac.c index 154a03a7..417beb17 100644 --- a/mt7996/mac.c +++ b/mt7996/mac.c @@ -3290,8 +3290,10 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw, flow->tsf = le64_to_cpu(twt_agrt->twt); if (mt7996_mcu_twt_agrt_update(dev, &msta->vif->deflink, flow, - MCU_TWT_AGRT_ADD)) + MCU_TWT_AGRT_ADD)) { + list_del(&flow->list); goto unlock; + } setup_cmd = TWT_SETUP_CMD_ACCEPT; dev->twt.table_mask |= BIT(table_id);