Re: [PATCH v6 2/3] wifi: rtw88: skip already reset station in rtw_sta_remove()

[Luka Gejak <luka.gejak@linux.dev>]

On November 13, 2026 4:47:03 AM GMT+01:00, Kalpesh Solanki
<skalpesh942@gmail.com> wrote:
>During firmware recovery, __fw_recovery_work() iterates over all
>stations and invokes rtw_sta_remove() via rtw_reset_sta_iter().
>
>If recovery is triggered concurrently with station teardown (such as
>during ieee80211_set_disassoc() where mac80211 leaves LPS before
>removing the AP station), rtw_ops_sta_remove() is subsequently called
>for the same station. This causes rtw_sta_remove() to execute twice,
>leading to a double free of si->mask and an underflow of rtwdev->sta_cnt.
>
>Cancel pending rate control work first, as rtw_ops_sta_rc_update() can
>still schedule rc_work after the station was reset. Then check si->vif
>and return early if the station was already reset. Clear si->vif,
>si->mask, and si->use_cfg_mask upon removal to ensure clean teardown
>and avoid a NULL pointer dereference in rtw_rate_mask_cfg() if mac80211
>re-adds the station across recovery restart.
>
>Fixes: 5c831644e1f4 ("rtw88: handle and recover when firmware crash")
>Cc: stable@vger.kernel.org
>Signed-off-by: Kalpesh Solanki <skalpesh942@gmail.com>
>---

Looks good to me,

Reviewed-by: Luka Gejak <luka.gejak@linux.dev>

Best regards,
Luka Gejak