[PATCH v2] wifi: mt76: add wcid publish check in mt76_sta_add

[Jiajia Liu]

On Tue, Jun 30, 2026 at 01:29:51PM +0200, Thorsten Leemhuis wrote:
> On 5/28/26 05:38, Jiajia Liu wrote:
> > Since mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add
> > to avoid reinitializing the wcid->poll_list.
> > 
> > Found dev->sta_poll_list corruption when using mt7925 and 7.1-rc4.
> 
> Jiajia Liu, Felox: given that the problem seems to be in 7.1, should we
> ask the stable team to pick this regression fix up, as this change was
> mainlined (as 20b126920a259d ("wifi: mt76: add wcid publish check in
> mt76_sta_add") [v7.2-rc1]), but lacks both a Fixes and a Stable tag?

Yes. It seems to be related to cbf5e61da660 ("wifi: mt76: initialize
more wcid fields mt76_wcid_init") [v6.14-rc1]. But I didn't reproduce
when I checked it out and tested. So Fixes was not added.

> 
> Ciao, Thorsten
> 
> > According to the corruption information, prev->next was changed to itself.
> > 
> > wlan0: disconnect from AP 90:fb:5d:94:8b:e3 for new auth to 90:fb:5d:94:8b:e2
> > wlan0: authenticate with 90:fb:5d:94:8b:e2 (local address=84:9e:56:9c:7e:6b)
> > wlan0: send auth to 90:fb:5d:94:8b:e2 (try 1/3)
> >  slab kmalloc-8k start ffff8c80958a6000 pointer offset 4160 size 8192
> > list_add corruption. prev->next should be next (ffff8c808a7488f8), but was ffff8c80958a7040. (prev=ffff8c80958a7040).
> > 
> >  mt76_wcid_add_poll+0x95/0xd0 [mt76]
> >  mt7925_mac_add_txs.part.0+0xa5/0xe0 [mt7925_common]
> >  mt7925_rx_check+0xa7/0xc0 [mt7925_common]
> >  mt76_dma_rx_poll+0x50d/0x790 [mt76]
> >  mt792x_poll_rx+0x52/0xe0 [mt792x_lib]
> > 
> > Signed-off-by: Jiajia Liu <liujiajia at kylinos.cn>
> > ---
> > 
> > Changes in v2:
> >   - use dev->wcid table instead of adding MT_WCID_FLAG_DRV_PUBLSH for
> >     wcid publish check suggested by Sean
> >   - subject and commit message update
> > 
> > ---
> >  drivers/net/wireless/mediatek/mt76/mac80211.c | 15 ++++++++++++---
> >  1 file changed, 12 insertions(+), 3 deletions(-)
> > 
> > diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
> > index 4ae5e4715a9c..b78b4cd206e0 100644
> > --- a/drivers/net/wireless/mediatek/mt76/mac80211.c
> > +++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
> > @@ -1576,6 +1576,7 @@ mt76_sta_add(struct mt76_phy *phy, struct ieee80211_vif *vif,
> >  {
> >  	struct mt76_wcid *wcid = (struct mt76_wcid *)sta->drv_priv;
> >  	struct mt76_dev *dev = phy->dev;
> > +	struct mt76_wcid *published;
> >  	int ret;
> >  	int i;
> >  
> > @@ -1595,11 +1596,19 @@ mt76_sta_add(struct mt76_phy *phy, struct ieee80211_vif *vif,
> >  		mtxq->wcid = wcid->idx;
> >  	}
> >  
> > -	ewma_signal_init(&wcid->rssi);
> > -	rcu_assign_pointer(dev->wcid[wcid->idx], wcid);
> > +	published = rcu_dereference_protected(dev->wcid[wcid->idx],
> > +					      lockdep_is_held(&dev->mutex));
> > +	if (published != wcid) {
> > +		WARN_ON_ONCE(published);
> > +		ewma_signal_init(&wcid->rssi);
> > +		rcu_assign_pointer(dev->wcid[wcid->idx], wcid);
> > +		mt76_wcid_init(wcid, phy->band_idx);
> > +	} else {
> > +		wcid->phy_idx = phy->band_idx;
> > +	}
> > +
> >  	phy->num_sta++;
> >  
> > -	mt76_wcid_init(wcid, phy->band_idx);
> >  out:
> >  	mutex_unlock(&dev->mutex);
> >