[PATCH wireless] wifi: mac80211: keep the radio index of a replaced chanctx

[Koral Ilgun <koralilgun@gmail.com>]

From: Koral Ilgun <koral.ilgun@adtran.com>

ieee80211_replace_chanctx() gives the replacing context radio index
-1. After the swap, the radio of the replaced context counts one
context less. If the wiphy has room for one more channel, the next
reservation on that radio creates a second context there, beyond
the channel limit of the radio.

On an mt7996 with three radios and no interface on one of them,
every second channel switch that a station follows then moves the
station alone to a new context. The driver retunes the radio while
the APs on the old context still count down their own switch.

The replacing context now takes the radio of the context that it
replaces, if the new channel is valid on that radio.

Fixes: 27d4c03441eb ("wifi: mac80211: add wiphy radio assignment and validation")
Signed-off-by: Koral Ilgun <koral.ilgun@adtran.com>
---
Tested with Linux 6.18 and the mac80211 of backports-7.2 on an MT7996
device with three radios, one of them without an interface. The station
followed 16 channel switches of its uplink, 50 s apart. Without this
change, every second switch added a second context on the 5 GHz radio,
and the station moved alone. With it, all 16 switches swapped the
context, and the station and its APs moved together.

 net/mac80211/chan.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 9cba79507767..b814619e6701 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -1457,6 +1457,7 @@ ieee80211_replace_chanctx(struct ieee80211_local *local,
 	struct ieee80211_chanctx *new_ctx, *ctx;
 	struct wiphy *wiphy = local->hw.wiphy;
 	const struct wiphy_radio *radio;
+	int radio_idx;
 
 	if (!curr_ctx ||
 	    curr_ctx->replace_state == IEEE80211_CHANCTX_WILL_BE_REPLACED ||
@@ -1506,7 +1507,20 @@ ieee80211_replace_chanctx(struct ieee80211_local *local,
 	    ieee80211_chanctx_num_reserved(local, curr_ctx) != 0)
 		return ERR_PTR(-EBUSY);
 
-	new_ctx = ieee80211_alloc_chanctx(local, chanreq, mode, -1);
+	/*
+	 * The new context takes the place of curr_ctx on its radio. Without
+	 * a radio index, ieee80211_num_chanctx() counts one context less on
+	 * that radio, and the next reservation can add a context beyond the
+	 * channel limit of the radio.
+	 */
+	radio_idx = curr_ctx->conf.radio_idx;
+	if (radio_idx >= 0) {
+		radio = &wiphy->radio[radio_idx];
+		if (!cfg80211_radio_chandef_valid(radio, &chanreq->oper))
+			radio_idx = -1;
+	}
+
+	new_ctx = ieee80211_alloc_chanctx(local, chanreq, mode, radio_idx);
 	if (!new_ctx)
 		return ERR_PTR(-ENOMEM);
 

base-commit: 25e73f1d6868c759c8eb56cad4e411692c5341b4
-- 
2.43.0