mirror of
https://github.com/outbackdingo/mt76.git
synced 2026-10-24 13:26:48 +00:00
Chad MonroeandFelix Fietkau
498e5ee815
The offchannel scan link is allocated in mt76_hw_scan() under dev->mutex, but torn down without it: mt76_scan_complete() runs from mt76_scan_work() on the mac80211 workqueue, or from mt76_abort_scan(), and calls mt76_put_vif_phy_link(), whose vif_link_remove clears the per-phy omac_mask and the device-wide vif_mask/mld_idx_mask with plain read-modify-write. A vif link add or remove for another interface, running concurrently under dev->mutex, can interleave with these unlocked writes and lose an update: a cleared bit belonging to a live link gets handed out again (two links sharing an omac/bss/wcid index, breaking own-MAC unicast RX for the first one), or a freed bit stays set until reboot and eventually exhausts the index space. Take dev->mutex around the scan completion, mirroring the ROC teardown in mt76_roc_complete_work()/mt76_abort_roc(), and switch the channel restore to __mt76_set_channel() since the caller now holds the lock. mt76_abort_scan() keeps cancelling the scan work before taking the mutex, so the work-vs-abort ordering is unchanged. Signed-off-by: Chad Monroe <[email protected]> Signed-off-by: Felix Fietkau <[email protected]>