gitops/mt76
1
0
Fork 0
mirror of https://github.com/outbackdingo/mt76.git synced 2026-10-24 05:16:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

wifi: mt76: mt7996: unlink TWT flow if the MCU rejects the agreement

Browse Source 
mt7996_mac_add_twt_setup() links a new flow into dev->twt_list before
asking the MCU to add the agreement, but exits without unlinking the flow
if the request fails. The flow-ID and table masks are only committed
after MCU success, so the still-linked flow is invisible to the
mask-gated teardown paths.

If the station retries the setup, the same slot is cleared and its
embedded list node reinitialized while it is still linked, corrupting
dev->twt_list. If the station disassociates instead, teardown skips the
flow and station storage can be freed while the node remains linked. A
later scheduling or debugfs twt_stats walk can then dereference the
freed flow, resulting in a use-after-free.

Unlink the flow when the MCU rejects the agreement. This restores the
list to its pre-request state while leaving the unchanged mask and
agreement accounting untouched.

Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Cc: [email protected]
Link: https://lore.kernel.org/all/[email protected]/
Assisted-by: Codex:gpt-5.6-sol
Assisted-by: Kimi:K3
Signed-off-by: Zhao Li <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
This commit is contained in:
Zhao Li
2026-09-01 13:25:05 +02:00
committed by Felix Fietkau
parent bd49f06353
commit d73f61254a
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mt7996/mac.c
+3 -1
View File
@@ -3290,8 +3290,10 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
flow->tsf = le64_to_cpu(twt_agrt->twt); flow->tsf = le64_to_cpu(twt_agrt->twt);
if (mt7996_mcu_twt_agrt_update(dev, &msta->vif->deflink, flow, if (mt7996_mcu_twt_agrt_update(dev, &msta->vif->deflink, flow,
MCU_TWT_AGRT_ADD)) MCU_TWT_AGRT_ADD)) {
list_del(&flow->list);
goto unlock; goto unlock;
}
setup_cmd = TWT_SETUP_CMD_ACCEPT; setup_cmd = TWT_SETUP_CMD_ACCEPT;
dev->twt.table_mask |= BIT(table_id); dev->twt.table_mask |= BIT(table_id);