From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dy1-f169.google.com (mail-dy1-f169.google.com [74.125.82.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A868836CDF8 for ; Tue, 20 Jan 2026 06:28:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768890539; cv=none; b=KLuKOKHVFhigAPGIJVEuJaMkq/XC4sd7PfYG2rcPMaOLrh24DX/izU0N3ju4G7qaLGotYktlQCtqS7TFfYADmkJSFOS4hUGfV1HfywPRoIycXwTpti81k1619cUQDkgqNR5F1qmaZGjqgfhvuvjLLZlmTfhDE/34fz38MznfhSo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768890539; c=relaxed/simple; bh=cf6IGNMMMwXticxB+OfAHFQxcYExa32hB22vyjEMBAA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=aK8mp9tZwi/hd12Uk+whgg4VCvL5ocmGTvdmannAbOqTy4AtqjdXcUNcpUw06v1EG1lw6mXQhrABQjdIoFVArnPOcD4yIZ1mdlNfeEmqoNf2qPPWbfG9P1YrjtlCHq2P50VBbR09Ua4UuzAsSiAAgeEJj80vYfRbWdOcBwicLQI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zacbowling.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=GNvsZae0; arc=none smtp.client-ip=74.125.82.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zacbowling.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="GNvsZae0" Received: by mail-dy1-f169.google.com with SMTP id 5a478bee46e88-2b453b17e41so3137152eec.1 for ; Mon, 19 Jan 2026 22:28:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1768890537; x=1769495337; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:from:to:cc:subject:date :message-id:reply-to; bh=YznedogKosCYjQoxhmZaws4K9eCkq32zETWn/NeO/UE=; b=GNvsZae07r9PFfsyRE30OwIfMWfbjvQSnhWShXOOiYAMXHtcWPJ3m9OkA2sFadnGdw fiT9fuRxJGodb0NLjANKiFCutMsN/mqBAGq7Xh8iBCHuJiNlKiy5qCePoUKxdMk4sbEg QvNHHhTG6DdgbF537biavjYJBPb63Ye2ZArnxNEpj/lhdkg2Tr3TWGhEXpCND9IscMn2 tRmFLapIJ0ITtfoy87D+wpGrHHO/UOGwsprUwcJ5R6/r5kkUCp6k7aGpemMM5TjWWrFB c2aVzTf46ljyhg5pyVwD84Pb9cVdZaZ5Y4MQcE/c5xMvbZTfa9bsSa6Cj5S6Orm+C4pT /tJA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768890537; x=1769495337; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=YznedogKosCYjQoxhmZaws4K9eCkq32zETWn/NeO/UE=; b=KhlpXJi892IGOOofMOzbvhkpTEkajLLqYrXwXe1bFaOQFpV2QFG5mxiU+qLUcZ0L4o 0coPE2K7ULNFPqkLREd9EXwGB6Dp5Px9Pu8kiM0ePg67ra1NPALpsJf2fBJB/wy8v6Hg fA7UGXqHYWHQfbww5mUsfBuQ4zGxXxkewDw5ziXYTSOuK2Ku7YOT156jEA6IVKTDfHYN L2IPiuOlA1g3UMCXO7/F9Y1VC+15VY64Diwd6AU2fFDNvv3cfD6pc5y6ztyjYbMQmtD+ 0Kk+Ok/OfzvI8OraBSEaNIyt4sBtgjJURIx1uEpHYGJsL8Gfq8l2Ptg8EkXeNT6q2ApI gqWg== X-Forwarded-Encrypted: i=1; AJvYcCWUiNgrzLtXWaDtOIskPFpMemYqqb2GtkJO7qQoeUFqtl3S0PgetbMYjaRKOyWkwYXAGYKRrRjXpjXmerE=@vger.kernel.org X-Gm-Message-State: AOJu0YyOhSK7Y3NPg0DD8hlYYOAYqMppOc2sPA+KjAuodp1kldwkoSLy WXM/NE8RvXzg++EAl5dSU5wqlyowMkqUf4GBERtfp3OPDk8+wCiQOV1G X-Gm-Gg: AZuq6aJ/ZM1kSP1ql6ztkQGvQlPHJYjzuf82MFJTkuq2v5bVjm08vntEQ+VVh/Thao6 WN8gv1pWKOrh+a0Hc8WPcOea8avY+5dMvESqiN7YSpus5tkQuuEtXnP4iCYGVaUlJZG9va2yK8O 82/pPfEnMDLn7qCrlGLXpWdKeH96FAFGb9PT8wCKjB67G5PRCgF3uUARasna+Olyj5kSpCJ1/MJ x2ePmA3M4BDP1dZXjPBwVD4GEK3R04ePG9MiEqk9f/UAwcTzeUOKksbjS+uoaRTKQt3yRBn1LJ0 W+TpEIJgoadhHVmya6fCP5YNTkcbdgn30MOPsg2MZW8ApwnfYKGFpYzczeI4tLbBF0eYWfc9/dE +/MrLwiMLtM7dAkMJW7wGtTdEM5p6hK7dhhaAMB95pwBj/Zj+SVlVRSYpQbWsw2/ZfDKO9jPw3l CNfVrqzXv9UL3OvGad6W1sdGrzhuafcs4d2veL62JzmGuEB4PK9kog66OZ3P1u X-Received: by 2002:a05:7300:7493:b0:2a4:701a:b9ba with SMTP id 5a478bee46e88-2b6b357e24dmr9383608eec.14.1768890536577; Mon, 19 Jan 2026 22:28:56 -0800 (PST) Received: from zcache.home.zacbowling.com ([2001:5a8:60d:bc9:f31e:1cb:296a:cc2a]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-2b6b3502c91sm15706784eec.9.2026.01.19.22.28.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 19 Jan 2026 22:28:56 -0800 (PST) Sender: Zac Bowling From: Zac To: sean.wang@kernel.org Cc: deren.wu@mediatek.com, kvalo@kernel.org, linux-kernel@vger.kernel.org, linux-mediatek@lists.infradead.org, linux-wireless@vger.kernel.org, lorenzo@kernel.org, nbd@nbd.name, ryder.lee@mediatek.com, sean.wang@mediatek.com, stable@vger.kernel.org, linux@frame.work, zbowling@gmail.com, Zac Bowling Subject: [PATCH v5 00/11] wifi: mt76: mt7925/mt7921 stability fixes Date: Mon, 19 Jan 2026 22:28:43 -0800 Message-ID: <20260120062854.126501-1-zac@zacbowling.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Zac Bowling This series addresses stability issues in the mt7925 (WiFi 7) and mt7921 drivers, focusing on NULL pointer dereferences, mutex protection, MLO (Multi-Link Operation) handling, and ROC (Remain-On-Channel) state machine fixes. Changes since v4: - Reorganized 27 patches into 11 cleaner, logically-grouped patches for easier review. Patches are now ordered by subsystem dependency: mt76 core -> mt792x shared -> mt7921 -> mt7925 - Consolidated ROC-related fixes (previously patches 22-27) into a single comprehensive patch (11/11) that addresses the interconnected deadlock and race condition issues discovered through extended testing - New issues fixed since v4: * ROC deadlock in sta removal path - cancel_work_sync() was waiting for roc_work which needed the mutex already held by sta_remove * ROC timer race during suspend - timer could fire after suspend started but before ROC was properly aborted * Async ROC abort race condition - double-free when async abort raced with normal ROC completion * Added ROC rate limiting with exponential backoff to mitigate MLO authentication failures caused by rapid ROC requests overwhelming the MT7925 firmware * Fixed spurious ieee80211_remain_on_channel_expired() callback when ROC wasn't actually active (found via code review) - Added corresponding mt7921 fixes (patches 3-4) since the older driver shares similar code paths and exhibited the same deadlock patterns - Firmware reload fix (patch 2) addresses crashes when the device needs recovery after a failed firmware load - the semaphore wasn't being released, causing subsequent loads to hang Investigation and Testing: All issues were discovered through real-world testing on Framework 16 laptops with the MT7925 (RZ616) WiFi module. Crash dumps, dmesg logs, and detailed analysis are available in the repository below. A DKMS version with extensive debug logging is available for community testing. This has been instrumental in tracking down the more subtle race conditions and deadlocks that only manifest under specific timing conditions. Repository: https://github.com/zbowling/mt7925 - kernels/ - Pre-built patches for 6.17, 6.18, 6.19-rc, nbd168 - dkms/ - DKMS module with extra debug logging - crashes/ - Crash investigation logs and analysis Acknowledgments: Thank you to the community members who tested the DKMS version and provided crash reports, dmesg dumps, and helped track down the more elusive deadlocks. Your patience and detailed bug reports made these fixes possible. Tested on MT7925 (RZ616) with kernels 6.17.13, 6.18.5, and 6.19-rc5. Zac Bowling (11): wifi: mt76: fix list corruption in mt76_wcid_cleanup wifi: mt76: mt792x: fix NULL pointer and firmware reload issues wifi: mt76: mt7921: add mutex protection in critical paths wifi: mt76: mt7921: fix deadlock in sta removal and suspend ROC abort wifi: mt76: mt7925: add comprehensive NULL pointer protection for MLO wifi: mt76: mt7925: add mutex protection in critical paths wifi: mt76: mt7925: add MCU command error handling wifi: mt76: mt7925: add lockdep assertions for mutex verification wifi: mt76: mt7925: fix MLO roaming and ROC setup issues wifi: mt76: mt7925: fix BA session teardown during beacon loss wifi: mt76: mt7925: fix ROC deadlocks and race conditions drivers/net/wireless/mediatek/mt76/mac80211.c | 8 + drivers/net/wireless/mediatek/mt76/mt76.h | 1 + drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 2 + drivers/net/wireless/mediatek/mt76/mt7921/main.c | 37 ++- drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 2 - drivers/net/wireless/mediatek/mt76/mt7921/sdio.c | 2 - drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 8 + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 257 +++++++++++++-- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 46 ++- drivers/net/wireless/mediatek/mt76/mt7925/pci.c | 4 + drivers/net/wireless/mediatek/mt76/mt792x.h | 7 + drivers/net/wireless/mediatek/mt76/mt792x_core.c | 17 +- 12 files changed, 340 insertions(+), 51 deletions(-) -- 2.52.0