From nobody Tue Feb 10 04:12:29 2026 Received: from mail-dy1-f182.google.com (mail-dy1-f182.google.com [74.125.82.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F400036C5B3 for ; Tue, 20 Jan 2026 06:28:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768890540; cv=none; b=ZPG1s3lTa2k5DcNkKtAhnuXm4XVTYB0MXUV9ZMUo8WsB79Zpf7tCWCzzuEKlrcCJU4cK1vhELuBRMWL4f+dxScmgH07KvzMQ1Q8UFMkOKAjQRh+3jIIi1T/QXwuE0MRL6UdiPsjHvp/isBPKcqX9yWyqtP2CJnF8lcRaKJ3qOCM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768890540; c=relaxed/simple; bh=2+HHCsL4CHpvAxtcpZ+oNfJ91XAAY5ApArx/L+V3+Ww=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=WxDLTDKyGC15Cfe15wM4hK+0e5Gp3EWnICGMsrYhhQ/WvY7WPYqAUhcgz5FZrK/JgPpD6LSr7d2ZYvVA9yKhBoh7EWBsAil2RXJT+mcl4LNYdnegO2YgOfmm+PslElG6wKmi/Ku7u7BAXPiFpD5jhEIBBwNC+5241f5yy9rbs0o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zacbowling.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=KfBVCy6B; arc=none smtp.client-ip=74.125.82.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zacbowling.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="KfBVCy6B" Received: by mail-dy1-f182.google.com with SMTP id 5a478bee46e88-2b6bf6adc65so4982769eec.0 for ; Mon, 19 Jan 2026 22:28:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1768890538; x=1769495338; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:from:to:cc:subject:date :message-id:reply-to; bh=hZqhvQUqHyPjd5YwFiryR+es7m9UdWSAqM9hdcVMAYY=; b=KfBVCy6Btat3on8k4RWjWohTf/kL/A3GiZd/jR1dWPTZ7i8oymlmP7SNvzFIyhz0XK 8nA5MBTVR2ZmcixOvOKqha7hwOgVfpEE4xClNZ9FbNCVyLLP1aa5qOCRci/93z/xAJ7y gGlVLb1IqjLb5qLobEpBugeiuNlaRdhzhF6g8sf8BY8uIZ7EuHNjUJsaWkjYu/EZCp7b ip0bDp+gWeLFxjsiP/2+eaSJkuHG8NRqay56tqxJeJ6D24Zf8zmryBhuoUKZjByAH3Hd zxBSCdt4hcC3HfQkao6ggL4hhq4z1UHu3RdOUQ5VVwsO6Wfat6XaFhuwUCErshY199Q/ x32g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768890538; x=1769495338; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=hZqhvQUqHyPjd5YwFiryR+es7m9UdWSAqM9hdcVMAYY=; b=NYsZZKlKwYAVM+zFAHb9mWMR7khjb9mXqCQs2vt4yf9gykDKN0wJXhNFrJLiJ2FImb B8AzDxqrCkh75xqfnSoI4zvytQiFLxQzkGKHuv0VjRf7s/8t2VrjZP6BOxOMz1wlgMUi fgCFUmn6UhnczLDGcuW7pquKvqkE6Ta7QoRnNtUIrLN8TpZpNHTb7KiJwe9WEHB20VRj qZA7MiLg2nmziPhkBrO1q9SjD7bJz6hs/RZ1QHD5risGNJ9Zb04QCOmVqzDazZv7Moj3 1PnPajYF1nPA8a+eiRDGHDbJW4hvoq7ARp58UzYUBEgJF++A+7mA76mhbt5qmloqD13W ts4g== X-Forwarded-Encrypted: i=1; AJvYcCXteWqmmTuRni8KMS4fHSvZaGnqBczCU6mrTzq7x7qbmk1oM4qcUXRvsu0eQfRwsKPsmGKx7AlrIfL2R4k=@vger.kernel.org X-Gm-Message-State: AOJu0YyqUlGG2MS2yNZuV0n7MINcjgcIlpsi9ZjTBhhfXwWL/UstFlTa el/FrN0+ICh/tzksTmnQndNyPiwQxhuhHSQw8k08ivlgOOdYVu410Pi3 X-Gm-Gg: AZuq6aIqC/ydhNkNQby0l0EOZCn9MUErlyZMLcd+W4l3tDGaPs20Izz0ODDbHeSd97I 8pSix9u7+sPZ32vSL2f65rhxy7LS2wFFwI0H0OfbiFcGVcA90IICG2+FmEk+s2nDmYPF+6XmhKm L5WvSLi4UlgEDoZ6PqIfnxNYizIAlsDEMlOo+fFJWTwtTz59hchug+OPPZhGc/wp9nIFelCfXQh x/f9+t21EaP5HsEln29x6H5NbACEnoKsSJW/ZMYvofinu8vM7an5AXraiF53aYggzjSLNcskL6U x/F6bPTKG5yT/nAy4sJgDBiNtMbJ6KNxYLhqBt4VZFqZGNsm0elgXauU9Ex4QOg4u6QFo3J2EkL IP4lmpW+KS3lG+MXvdkD7ZMRbbUdlgaevR/EjIveceI/sdecV3+leZ4IG7lZJEG9XDarbAnUHlU +S19R1ferNbgVrrVMIww1asyHTMeLYegxeM2wvPCwprflW4oV6NK/gxzD3uw1HEXont20EW/g= X-Received: by 2002:a05:7300:6420:b0:2ac:1c5a:9950 with SMTP id 5a478bee46e88-2b6b4e98df3mr12535391eec.34.1768890538000; Mon, 19 Jan 2026 22:28:58 -0800 (PST) Received: from zcache.home.zacbowling.com ([2001:5a8:60d:bc9:f31e:1cb:296a:cc2a]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-2b6b3502c91sm15706784eec.9.2026.01.19.22.28.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 19 Jan 2026 22:28:57 -0800 (PST) Sender: Zac Bowling From: Zac To: sean.wang@kernel.org Cc: deren.wu@mediatek.com, kvalo@kernel.org, linux-kernel@vger.kernel.org, linux-mediatek@lists.infradead.org, linux-wireless@vger.kernel.org, lorenzo@kernel.org, nbd@nbd.name, ryder.lee@mediatek.com, sean.wang@mediatek.com, stable@vger.kernel.org, linux@frame.work, zbowling@gmail.com, Zac Bowling Subject: [PATCH 01/11] wifi: mt76: fix list corruption in mt76_wcid_cleanup Date: Mon, 19 Jan 2026 22:28:44 -0800 Message-ID: <20260120062854.126501-2-zac@zacbowling.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260120062854.126501-1-zac@zacbowling.com> References: <20260120062854.126501-1-zac@zacbowling.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Zac Bowling mt76_wcid_cleanup() was not removing wcid entries from sta_poll_list before mt76_reset_device() reinitializes the master list. This leaves stale pointers in wcid->poll_list, causing list corruption when mt76_wcid_add_poll() later checks list_empty() and tries to add the entry back. The fix adds proper cleanup of poll_list in mt76_wcid_cleanup(), matching how tx_list is already handled. This is similar to what mt7996_mac_sta_deinit_link() already does correctly. Fixes list corruption warnings like: list_add corruption. prev->next should be next (ffffffff...) Signed-off-by: Zac Bowling --- drivers/net/wireless/mediatek/mt76/mac80211.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wi= reless/mediatek/mt76/mac80211.c index 75772979f438..d0c522909e98 100644 --- a/drivers/net/wireless/mediatek/mt76/mac80211.c +++ b/drivers/net/wireless/mediatek/mt76/mac80211.c @@ -1716,6 +1716,16 @@ void mt76_wcid_cleanup(struct mt76_dev *dev, struct = mt76_wcid *wcid) =20 idr_destroy(&wcid->pktid); =20 + /* Remove from sta_poll_list to prevent list corruption after reset. + * Without this, mt76_reset_device() reinitializes sta_poll_list but + * leaves wcid->poll_list with stale pointers, causing list corruption + * when mt76_wcid_add_poll() checks list_empty(). + */ + spin_lock_bh(&dev->sta_poll_lock); + if (!list_empty(&wcid->poll_list)) + list_del_init(&wcid->poll_list); + spin_unlock_bh(&dev->sta_poll_lock); + spin_lock_bh(&phy->tx_lock); =20 if (!list_empty(&wcid->tx_list)) --=20 2.52.0