[PATCH 0/4] wifi: unwind state after add_interface failures

[PATCH 0/4] wifi: unwind state after add_interface failures

[Jiale Yao]

mac80211 does not call remove_interface() when a driver's
add_interface() callback fails.  Drivers must therefore unwind all state
they published before returning the error.

Four wireless drivers leave vif pointers or resource reservations behind
when a firmware operation fails during interface creation.  Depending on
the driver, later RX, interrupt, or testmode paths can dereference the stale
vif, and leaked mask bits or counters can prevent subsequent interfaces
from being created.

Unwind the state at each failure point, following the approach used by
commit 2fb6480c52f6 ("wifi: mt76: mt7915: unwind state on add_interface
failure").  Each patch is independent and addresses one driver.

These paths were reviewed against the driver state transitions and their
remove_interface() counterparts.

Jiale Yao (4):
  wifi: mt76: mt7615: unwind add_interface failures
  wifi: mt76: mt7925: unwind link BSS add failures
  wifi: rsi: unwind add_interface failure
  wifi: mm81x: unwind add_interface failure

 .../net/wireless/mediatek/mt76/mt7615/main.c  | 19 ++++++++++++++++++-
 .../net/wireless/mediatek/mt76/mt7925/main.c  |  4 +++-
 drivers/net/wireless/morsemicro/mm81x/mac.c   |  9 ++++++++-
 drivers/net/wireless/rsi/rsi_91x_mac80211.c   |  2 ++
 4 files changed, 31 insertions(+), 3 deletions(-)

-- 
2.34.1

[PATCH 1/4] wifi: mt76: mt7615: unwind add_interface failures

[Jiale Yao]

mac80211 does not call remove_interface() after add_interface() fails, so
the driver must undo any state it published before returning an error.

mt7615_add_interface() records a monitor vif before resource allocation,
and later reserves vif and OMAC bits and publishes the station WCID.  An
allocation or firmware failure leaves some or all of that state behind.
The stale monitor_vif can then be used by the testmode transmit path after
mac80211 frees the vif, while the leaked mask bits permanently consume
interface resources.

Unpublish the WCID and release its resources when adding device information
fails, clear the reserved mask bits after failures that occur after their
allocation, and clear monitor_vif on every failed add.

Commit 2fb6480c52f6 ("wifi: mt76: mt7915: unwind state on add_interface
failure") fixed the same failure-unwind issue in mt7915.

Fixes: 4f0bce1c8888 ("mt76: mt7615: implement testmode support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 .../net/wireless/mediatek/mt76/mt7615/main.c  | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/main.c b/drivers/net/wireless/mediatek/mt76/mt7615/main.c
index 67f56e428d9a..d20b109666dc 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/main.c
@@ -219,7 +219,7 @@ static int mt7615_add_interface(struct ieee80211_hw *hw,
 
 	ret = mt7615_mcu_set_dbdc(dev);
 	if (ret)
-		goto out;
+		goto err_mask;
 
 	idx = MT7615_WTBL_RESERVED - mvif->mt76.idx;
 
@@ -237,7 +237,24 @@ static int mt7615_add_interface(struct ieee80211_hw *hw,
 	}
 
 	ret = mt7615_mcu_add_dev_info(phy, vif, true);
+	if (ret)
+		goto err_wcid;
+
+	mt7615_mutex_release(dev);
+
+	return 0;
+
+err_wcid:
+	rcu_assign_pointer(dev->mt76.wcid[idx], NULL);
+	mt76_wcid_cleanup(&dev->mt76, &mvif->sta.wcid);
+err_mask:
+	dev->mt76.vif_mask &= ~BIT_ULL(mvif->mt76.idx);
+	dev->omac_mask &= ~BIT_ULL(mvif->mt76.omac_idx);
+	phy->omac_mask &= ~BIT_ULL(mvif->mt76.omac_idx);
 out:
+	if (phy->monitor_vif == vif)
+		phy->monitor_vif = NULL;
+
 	mt7615_mutex_release(dev);
 
 	return ret;
-- 
2.34.1

[PATCH 2/4] wifi: mt76: mt7925: unwind link BSS add failures

[Jiale Yao]

mac80211 does not call remove_interface() after add_interface() fails, so
the driver must undo any state it published before returning an error.

mt7925_mac_link_bss_add() reserves vif and OMAC bits and publishes the
station WCID before asking the firmware to add the device.  If that command
fails, the function currently returns with those resources still installed.
The WCID pointer then refers into vif private data that mac80211 can free,
and the mask bits remain permanently allocated.

Use the existing link BSS removal helper to undo the published WCID, mask
bits, and WCID resources when the firmware add command fails.

Commit 2fb6480c52f6 ("wifi: mt76: mt7915: unwind state on add_interface
failure") fixed the same failure-unwind issue in mt7915.

Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/mediatek/mt76/mt7925/main.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
index 5993b31e1aae..25ad3bbdcd2c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
@@ -439,8 +439,10 @@ static int mt7925_mac_link_bss_add(struct mt792x_dev *dev,
 
 	ret = mt76_connac_mcu_uni_add_dev(&dev->mphy, link_conf, &mconf->mt76,
 					  &mlink->wcid, true);
-	if (ret)
+	if (ret) {
+		mt792x_mac_link_bss_remove(dev, mconf, mlink);
 		goto out;
+	}
 
 	if (vif->txq) {
 		mtxq = (struct mt76_txq *)vif->txq->drv_priv;
-- 
2.34.1

[PATCH 3/4] wifi: rsi: unwind add_interface failure

[Jiale Yao]

mac80211 does not call remove_interface() after add_interface() fails, so
the driver must undo any state it published before returning an error.

rsi_mac80211_add_interface() stores the vif in adapter->vifs[] and
increments sc_nvifs before sending the VAP capabilities command.  If that
command fails, the function returns without undoing either update.  The
array entry can therefore refer to vif memory freed by mac80211, while the
interface count remains inflated.

Clear the vif slot and restore sc_nvifs when setting VAP capabilities
fails, mirroring the state cleanup in remove_interface().

Commit 2fb6480c52f6 ("wifi: mt76: mt7915: unwind state on add_interface
failure") fixed the same failure-unwind pattern in another wireless driver.

Fixes: b8bd3a439f35 ("rsi: add/remove interface enhancements for p2p")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/rsi/rsi_91x_mac80211.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
index 3faf2235728b..34ddcbc43fdc 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
@@ -518,6 +518,8 @@ static int rsi_mac80211_add_interface(struct ieee80211_hw *hw,
 	if (rsi_set_vap_capabilities(common, intf_mode, vif->addr,
 				     vif_info->vap_id, vap_status)) {
 		rsi_dbg(ERR_ZONE, "Failed to set VAP capabilities\n");
+		adapter->vifs[vap_idx] = NULL;
+		adapter->sc_nvifs--;
 		mutex_unlock(&common->mutex);
 		return -EINVAL;
 	}
-- 
2.34.1

[PATCH 4/4] wifi: mm81x: unwind add_interface failure

[Jiale Yao]

mac80211 does not call remove_interface() after add_interface() fails, so
the driver must undo any state it published before returning an error.

mm81x_mac_ops_add_interface() publishes the vif through the RCU-protected
vif table and initializes AP beacon handling before querying firmware
capabilities.  If that query fails, the published pointer remains after
mac80211 frees the vif.  Interrupt processing can then retrieve and
dereference the stale vif.

Finish AP beacon handling, clear the RCU slot, and ask the firmware to
remove the interface when the capabilities query fails.  Preserve the
original query error if firmware cleanup also fails.

Commit 2fb6480c52f6 ("wifi: mt76: mt7915: unwind state on add_interface
failure") fixed the same failure-unwind pattern in another wireless driver.

Fixes: b1906cea00b0 ("wifi: mm81x: add mm81x Wi-Fi HaLow driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/morsemicro/mm81x/mac.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/morsemicro/mm81x/mac.c b/drivers/net/wireless/morsemicro/mm81x/mac.c
index 0fa80b1488aa..1edad7eace61 100644
--- a/drivers/net/wireless/morsemicro/mm81x/mac.c
+++ b/drivers/net/wireless/morsemicro/mm81x/mac.c
@@ -2169,7 +2169,7 @@ static int mm81x_mac_restart(struct mm81x *mors)
 static int mm81x_mac_ops_add_interface(struct ieee80211_hw *hw,
 				       struct ieee80211_vif *vif)
 {
-	int ret = 0;
+	int cleanup_ret, ret = 0;
 	struct mm81x *mors = hw->priv;
 	struct mm81x_vif *mors_vif = (struct mm81x_vif *)vif->drv_priv;
 
@@ -2221,6 +2221,13 @@ static int mm81x_mac_ops_add_interface(struct ieee80211_hw *hw,
 		dev_err(mors->dev,
 			"mm81x_cmd_get_capabilities failed for vif %d",
 			mors_vif->id);
+		if (vif->type == NL80211_IFTYPE_AP)
+			mm81x_mac_beacon_finish(mors_vif);
+		RCU_INIT_POINTER(mors->vifs[mors_vif->id], NULL);
+		cleanup_ret = mm81x_cmd_rm_if(mors, mors_vif->id);
+		if (cleanup_ret)
+			dev_err(mors->dev, "mm81x_cmd_rm_if failed %d",
+				cleanup_ret);
 		return ret;
 	}
 
-- 
2.34.1