[PATCH 0/4] wifi: unwind failed interface setup and recovery

[PATCH 0/4] wifi: unwind failed interface setup and recovery

[Jiale Yao]

Several wireless interface setup and reset recovery paths publish host
pointers or create firmware state before later operations which can fail.
Their error paths either retain pointers to vifs that mac80211 will free
or continue after firmware interface restoration has failed.

Clear the published ath10k and iwlwifi pointers on add failure. Check the
mt7921 and mt7925 firmware restore results, remove partial state and stop
configuring the affected interface. Each patch fixes an independent
driver path and can be applied separately.

Jiale Yao (4):
  wifi: ath10k: clear monitor interface after add failure
  wifi: iwlwifi: mvm: clear P2P device pointer on add failure
  wifi: mt76: mt7921: unwind interface restore failures
  wifi: mt76: mt7925: unwind link restore failures

 drivers/net/wireless/ath/ath10k/mac.c         |  1 +
 .../wireless/intel/iwlwifi/mvm/mld-mac80211.c |  5 +++-
 .../net/wireless/mediatek/mt76/mt7921/mac.c   | 16 +++++++++---
 .../net/wireless/mediatek/mt76/mt7925/mac.c   | 26 ++++++++++++++++---
 4 files changed, 41 insertions(+), 7 deletions(-)

-- 
2.34.1

[PATCH 1/4] wifi: ath10k: clear monitor interface after add failure

[Jiale Yao]

ath10k_add_interface() publishes the monitor vif before recalculating the
monitor configuration. If that operation fails, the interface addition is
unwound but monitor_arvif still points at the vif that mac80211 will free.

Clear the published pointer before entering the common vdev cleanup path.

Fixes: 500ff9f9389d ("ath10k: implement chanctx API")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/ath/ath10k/mac.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 8e604697d6c2..36b694ae6de4 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -5875,6 +5875,7 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
 		ret = ath10k_monitor_recalc(ar);
 		if (ret) {
 			ath10k_warn(ar, "failed to recalc monitor: %d\n", ret);
+			ar->monitor_arvif = NULL;
 			goto err_peer_delete;
 		}
 	}
-- 
2.34.1

[PATCH 2/4] wifi: iwlwifi: mvm: clear P2P device pointer on add failure

[Jiale Yao]

The MLD add_interface path publishes p2p_device_vif before updating power
configuration. If that update fails, the remaining interface state is
unwound but the pointer still refers to the vif that mac80211 will free.

Clear the P2P device pointer before entering the common cleanup path.

Fixes: 84ef7cbe90e9 ("wifi: iwlwifi: mvm: Don't always bind/link the P2P Device interface")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c
index 6ea9a7c8da0c..b1d4419a236c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c
@@ -74,8 +74,11 @@ static int iwl_mvm_mld_mac_add_interface(struct ieee80211_hw *hw,
 		mvm->p2p_device_vif = vif;
 
 	ret = iwl_mvm_power_update_mac(mvm);
-	if (ret)
+	if (ret) {
+		if (vif->type == NL80211_IFTYPE_P2P_DEVICE)
+			mvm->p2p_device_vif = NULL;
 		goto out_free_bf;
+	}
 
 	iwl_mvm_tcm_add_vif(mvm, vif);
 
-- 
2.34.1

[PATCH 3/4] wifi: mt76: mt7921: unwind interface restore failures

[Jiale Yao]

The reset recovery callback ignores failures while restoring an interface
in firmware and continues issuing per-vif configuration commands. A failed
two-command device addition can leave partial firmware state, while the
following commands operate on an interface that was not restored.

Check the restore result, remove any partially created firmware state and
stop configuring that interface on failure.

Fixes: 0c1ce9884607 ("mt76: mt7921: add wifi reset support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
index 6f5e31489e2d..0d19f2d7dd5e 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
@@ -628,13 +628,23 @@ mt7921_vif_connect_iter(void *priv, u8 *mac,
 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
 	struct mt792x_dev *dev = mvif->phy->dev;
 	struct ieee80211_hw *hw = mt76_hw(dev);
+	int ret;
 
 	if (vif->type == NL80211_IFTYPE_STATION)
 		ieee80211_disconnect(vif, true);
 
-	mt76_connac_mcu_uni_add_dev(&dev->mphy, &vif->bss_conf,
-				    &mvif->bss_conf.mt76,
-				    &mvif->sta.deflink.wcid, true);
+	ret = mt76_connac_mcu_uni_add_dev(&dev->mphy, &vif->bss_conf,
+					  &mvif->bss_conf.mt76,
+					   &mvif->sta.deflink.wcid, true);
+	if (ret) {
+		mt76_connac_mcu_uni_add_dev(&dev->mphy, &vif->bss_conf,
+					    &mvif->bss_conf.mt76,
+					    &mvif->sta.deflink.wcid, false);
+		dev_err(dev->mt76.dev,
+			"failed to restore interface after reset: %d\n", ret);
+		return;
+	}
+
 	mt7921_mcu_set_tx(dev, vif);
 
 	if (vif->type == NL80211_IFTYPE_AP) {
-- 
2.34.1

[PATCH 4/4] wifi: mt76: mt7925: unwind link restore failures

[Jiale Yao]

The reset recovery callback ignores failures while restoring each link in
firmware and continues configuring the link and remaining interface. A
failed two-command device addition can leave partial firmware state, while
links restored earlier in the loop remain active on a partially restored
interface.

Track every attempted link and remove their firmware state if any restore
operation fails. Stop configuring that interface after the failure.

Fixes: 14061994184d ("wifi: mt76: mt7925: add link handling in mt7925_vif_connect_iter")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 .../net/wireless/mediatek/mt76/mt7925/mac.c   | 26 ++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mac.c b/drivers/net/wireless/mediatek/mt76/mt7925/mac.c
index 7af996abe294..7b29e147b19e 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mac.c
@@ -1477,11 +1477,12 @@ mt7925_vif_connect_iter(void *priv, u8 *mac,
 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
 	unsigned long valid = ieee80211_vif_is_mld(vif) ?
 			      mvif->valid_links : BIT(0);
+	unsigned long restored = 0;
 	struct mt792x_dev *dev = mvif->phy->dev;
 	struct ieee80211_hw *hw = mt76_hw(dev);
 	struct ieee80211_bss_conf *bss_conf;
 	struct mt792x_bss_conf *mconf;
-	int i;
+	int i, ret;
 
 	if (vif->type == NL80211_IFTYPE_STATION)
 		ieee80211_disconnect(vif, true);
@@ -1493,8 +1494,13 @@ mt7925_vif_connect_iter(void *priv, u8 *mac,
 
 		mconf = mt792x_vif_to_link(mvif, i);
 
-		mt76_connac_mcu_uni_add_dev(&dev->mphy, bss_conf, &mconf->mt76,
-					    &mvif->sta.deflink.wcid, true);
+		restored |= BIT(i);
+		ret = mt76_connac_mcu_uni_add_dev(&dev->mphy, bss_conf,
+						  &mconf->mt76,
+						 &mvif->sta.deflink.wcid, true);
+		if (ret)
+			goto rollback;
+
 		mt7925_mcu_set_tx(dev, bss_conf);
 	}
 
@@ -1506,6 +1512,20 @@ mt7925_vif_connect_iter(void *priv, u8 *mac,
 				      MT76_STA_INFO_STATE_NONE, NULL);
 		mt7925_mcu_uni_add_beacon_offload(dev, hw, vif, true);
 	}
+
+	return;
+
+rollback:
+	dev_err(dev->mt76.dev, "failed to restore link after reset: %d\n", ret);
+	for_each_set_bit(i, &restored, IEEE80211_MLD_MAX_NUM_LINKS) {
+		bss_conf = mt792x_vif_to_bss_conf(vif, i);
+		if (!bss_conf)
+			continue;
+
+		mconf = mt792x_vif_to_link(mvif, i);
+		mt76_connac_mcu_uni_add_dev(&dev->mphy, bss_conf, &mconf->mt76,
+					    &mvif->sta.deflink.wcid, false);
+	}
 }
 
 /* system error recovery */
-- 
2.34.1