diff options
| author | Zhao Li <enderaoelyther@gmail.com> | 2026-08-25 19:26:20 +0800 |
|---|---|---|
| committer | Felix Fietkau <nbd@nbd.name> | 2026-10-07 12:50:41 +0200 |
| commit | 022f5f8b7a0580da50fcbc34da853d03d4321fe2 (patch) | |
| tree | 1f21655a9730b9788438f208eb60f87732bc057f /drivers/net | |
| parent | f8794eb3ff6dedbba0337c5197626b62da0ef057 (diff) | |
| download | linux-022f5f8b7a0580da50fcbc34da853d03d4321fe2.tar.gz linux-022f5f8b7a0580da50fcbc34da853d03d4321fe2.zip | |
wifi: mt76: mt7996: unlink TWT flow if the MCU rejects the agreement
mt7996_mac_add_twt_setup() links a new flow into dev->twt_list before
asking the MCU to add the agreement, but exits without unlinking the flow
if the request fails. The flow-ID and table masks are only committed
after MCU success, so the still-linked flow is invisible to the
mask-gated teardown paths.
If the station retries the setup, the same slot is cleared and its
embedded list node reinitialized while it is still linked, corrupting
dev->twt_list. If the station disassociates instead, teardown skips the
flow and station storage can be freed while the node remains linked. A
later scheduling or debugfs twt_stats walk can then dereference the
freed flow, resulting in a use-after-free.
Unlink the flow when the MCU rejects the agreement. This restores the
list to its pre-request state while leaving the unchanged mask and
agreement accounting untouched.
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20260729173632.14387-3-enderaoelyther@gmail.com/
Assisted-by: Codex:gpt-5.6-sol
Assisted-by: Kimi:K3
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Link: https://patch.msgid.link/20260825112620.97568-1-enderaoelyther@gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c index 898cd9b8ff96..a8c4f629109b 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c @@ -3288,8 +3288,10 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw, flow->tsf = le64_to_cpu(twt_agrt->twt); if (mt7996_mcu_twt_agrt_update(dev, &msta->vif->deflink, flow, - MCU_TWT_AGRT_ADD)) + MCU_TWT_AGRT_ADD)) { + list_del(&flow->list); goto unlock; + } setup_cmd = TWT_SETUP_CMD_ACCEPT; dev->twt.table_mask |= BIT(table_id); |