From nobody Tue Feb 10 05:26:48 2026 Received: from mail-dl1-f46.google.com (mail-dl1-f46.google.com [74.125.82.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 57CEB3AA1AD for ; Tue, 20 Jan 2026 20:11:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768939885; cv=none; b=l305k25MX/djmpDJnA0TLDUN+r/gVoP/BnpwO84u8MYQXEVAQOlTy/WMnp3XMb5MXKmwBxtQ996xaE9sAVD026W4ZPDACot/EU2f38xSirAndq8Wm5GXhHEFvVCu0N+cAHT2H8CVWKkF0V/OKJ3g51TbFq71H9ECmYeWfKWzKBw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768939885; c=relaxed/simple; bh=6af2zsceAUfdt9/tN2Gh7ZwQQh4wM8zkAusXvjcpOHs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=e3tqMk+O+5JmsrzldHdUoG5X6sOdEfNxoZ+wzzeqPXYZV7TYiP1R03PeRAXhPKcJzUSQHZxhtZy4Dw98GqYj4n80AaesJu6i4oD0E9H1cTjP5tYm8ap4jCDv2nqBD12De2Xa4RR3os//QfQ+s2ih1jNb1IN+J+9bJqjRyuou34w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zacbowling.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=LToLwIrg; arc=none smtp.client-ip=74.125.82.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zacbowling.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="LToLwIrg" Received: by mail-dl1-f46.google.com with SMTP id a92af1059eb24-12339e2e2c1so170063c88.1 for ; Tue, 20 Jan 2026 12:11:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1768939878; x=1769544678; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:from:to:cc:subject:date :message-id:reply-to; bh=gyEJCUGxWh8NOcDt1pHqHJNYXEMGHKOoRcUV6C7L5qs=; b=LToLwIrgQDvLjLDN55Htq0QEieVFtaxvsBQ4bKBLp1dqLKH0O7m0wBlJgIBDlmE06D 8KSt9MRcHfHltN0Szw3/TJosaZAjmSHk9vayu/G9pxaRPiB0HsXCEozvDZtwK8NzG/iR 4j/xeYdYsjR3Rz6MbaMEs1NuNSN6Ke9i/Rml3X3u5cIBSohO0Bf3G0AMYfROMzVjQCNl rLNAeCQ0QEvY/e1tnZpirAaretV/qqc8CUeepflX3V+ebNPOXJuGk6RK1bUCx7jVjRJk gbbqLbnU+teqi4vjX62jwvveQByw4GFkDlFeZwDYiWwTsBxokuJh2Cj0QtqJvx3RYPts L85A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768939878; x=1769544678; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=gyEJCUGxWh8NOcDt1pHqHJNYXEMGHKOoRcUV6C7L5qs=; b=AICW5sdLhRbndH0W3+zzniaRY5vLCYRSr3CQB94WZc+F/I1knEW7AbSAbQ7ULeUuXs j5NgxdWAurWYMX4ML75B6X5rZMTal+X9Xau9t68z66D9/88HocWTvwIpwpjQfZdeZpLP Fg6GnqU/dCpASeK+velXA0PSmtSiCncnZtyi9SHNFwXJJg7/0QRhuG/0Be3FJVHTEB0G TKS07PO0p750PZ4Klr93B+2rRQLlxSrXFMeNsCZFPv13AgIFbtdhjQVog0GF4YV34eSn VAhlmY7Tmpds6HsCtWpPJ0THJsOTV1Of4R2CYCF7jzxscWZn9fbUEmtuEIPqsWIPgv/X fy6w== X-Forwarded-Encrypted: i=1; AJvYcCUn2N8Prof0x1yopGhxPGKVa5apjF20+W/WBxpAXBomADoIZfqyIbbhd0U3wAD5NcZDWWiZ+hvtaVudp+4=@vger.kernel.org X-Gm-Message-State: AOJu0YxtNmME2POx7AKOA/KB1FttJAhQyLYt2ybO6YavEWny7Lm0IYJl 5s3DMLatzRN4rsIjN1bQ8z99AX9/tn2rI2AVO9akl9QuGXb7aNuf4b3I X-Gm-Gg: AY/fxX5ztkA0qojXDH//NE4VjyG8M8Cv2KtUOefsbwp97nr84UZE8ms/1fDNnhtyT7n SmYnRPzVxlzSkZMB3VtdOOG5jb6Lpx39WVXYT6QXmMHBbdOrAB2Xvbz3F/HjR86e2/YXOm7pYrq Kpc/2/zkIiDO/2va8zG82Aw32oE1eOp7O72wozpqcIFvwDp3XNJdDs12+3bugly34xCQ82F2Wj3 O8BfaIeM8Xx5/6wZeu8uAtWGi4bHmX1bodyUDaL/OUNJdn500nZCscsaHlAJtU0SSlQ0wTArast 9Fh19pw4evs3jFRdkcnUdp3lk7OQnckjkLDUBjytwSl0MUlknjiAgeipeFr8vlaYk6Su8Rkv9rT c8JqTJGzOce24NiOeHv+9ACSL64+Sn2fTa7ZpoZHPKffgGxjmeefVcTbUIibhlxDITcGCKBfabB BYBzJ7AkPy2Ql/gwZuFDSpWHxCsXyy6QFlrtMrYs5aU6FEZfutaBg+x5Vb99UJLw== X-Received: by 2002:a05:7022:140c:b0:123:3c24:b15 with SMTP id a92af1059eb24-1233d0ed5bfmr9477991c88.19.1768939878038; Tue, 20 Jan 2026 12:11:18 -0800 (PST) Received: from zcache.home.zacbowling.com ([2001:5a8:60d:bc9:4a3c:9f7c:8037:90c1]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-1244ad7201fsm21982990c88.7.2026.01.20.12.11.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Jan 2026 12:11:16 -0800 (PST) Sender: Zac Bowling From: Zac To: sean.wang@kernel.org Cc: deren.wu@mediatek.com, kvalo@kernel.org, linux-kernel@vger.kernel.org, linux-mediatek@lists.infradead.org, linux-wireless@vger.kernel.org, linux@frame.work, lorenzo@kernel.org, nbd@nbd.name, ryder.lee@mediatek.com, sean.wang@mediatek.com, zac@zacbowling.com, zbowling@gmail.com Subject: [PATCH 13/13] wifi: mt76: mt7925: fix double wcid initialization race condition Date: Tue, 20 Jan 2026 12:10:43 -0800 Message-ID: <20260120201043.38225-14-zac@zacbowling.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260120201043.38225-1-zac@zacbowling.com> References: <20260120201043.38225-1-zac@zacbowling.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Remove duplicate mt76_wcid_init() call in mt7925_mac_link_sta_add that occurs after the wcid is already published via rcu_assign_pointer(). The wcid is correctly initialized at line 1023 after allocation. However, a second mt76_wcid_init() call at line 1036 reinitializes the wcid after it has been published to RCU readers, which can cause: - List head corruption (tx_list, poll_list) if concurrent code is already using the wcid - Memory leaks from reinitializing the pktid IDR - Race conditions where readers see partially initialized state This appears to be a refactoring error where the duplicate call was left behind. Fixes: TBD ("wifi: mt76: mt7925: add MLO support") Signed-off-by: Zac Bowling --- drivers/net/wireless/mediatek/mt76/mt7925/main.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net= /wireless/mediatek/mt76/mt7925/main.c index 4b7c13485497..acce21ad3a29 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c +++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c @@ -1033,7 +1033,6 @@ static int mt7925_mac_link_sta_add(struct mt76_dev *m= dev, wcid =3D &mlink->wcid; ewma_signal_init(&wcid->rssi); rcu_assign_pointer(dev->mt76.wcid[wcid->idx], wcid); - mt76_wcid_init(wcid, 0); ewma_avg_signal_init(&mlink->avg_ack_signal); memset(mlink->airtime_ac, 0, sizeof(msta->deflink.airtime_ac)); --=20 2.52.0