mirror of
https://github.com/outbackdingo/mt76.git
synced 2026-10-24 05:16:57 +00:00
Felix Fietkau
ab6abc9713
Prevent mt76_scan_rx_beacon() in softirq from requeuing scan_work after cancel_delayed_work_sync() returns in mt76_abort_scan(). Without synchronization, the beacon handler can observe beacon_wait as true and requeue scan_work between the cancel and the memset in mt76_scan_complete(), leading to a NULL pointer dereference when scan_work runs against zeroed scan state. Introduce scan_lock (placed outside the scan struct to survive the memset) to make the beacon handler's check-and-queue atomic with respect to abort_scan's clear of beacon_wait. This eliminates the race with a single cancel_delayed_work_sync() call. Signed-off-by: Felix Fietkau <[email protected]>