[PATCH v2] wifi: mt76: add wcid publish check in mt76_sta_add

[Thorsten Leemhuis]

On 7/1/26 07:39, Jiajia Liu wrote:
> On Tue, Jun 30, 2026 at 01:29:51PM +0200, Thorsten Leemhuis wrote:
>> On 5/28/26 05:38, Jiajia Liu wrote:
>>> Since mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add
>>> to avoid reinitializing the wcid->poll_list.
>>>
>>> Found dev->sta_poll_list corruption when using mt7925 and 7.1-rc4.
>>
>> Jiajia Liu, Felox:

BTW: @Felix, sorry for the typo!

>> given that the problem seems to be in 7.1, should we
>> ask the stable team to pick this regression fix up, as this change was
>> mainlined (as 20b126920a259d ("wifi: mt76: add wcid publish check in
>> mt76_sta_add") [v7.2-rc1]), but lacks both a Fixes and a Stable tag?
> 
> Yes. It seems to be related to cbf5e61da660 ("wifi: mt76: initialize
> more wcid fields mt76_wcid_init") [v6.14-rc1]. But I didn't reproduce
> when I checked it out and tested. So Fixes was not added.

In that case:

@Stable team, you you please pick up 20b126920a259d ("wifi: mt76: add
wcid publish check in mt76_sta_add") [v7.2-rc1] for 7.1? It lacks a
fixes tag and the problem might be older, but I saw two reports about
this with 7.1-rc -- so it seems some recent change made that problem
more likely to occur, so it might be good to fix it at least in 7.1.y.

Ciao, Thorsten

>>> According to the corruption information, prev->next was changed to itself.
>>>
>>> wlan0: disconnect from AP 90:fb:5d:94:8b:e3 for new auth to 90:fb:5d:94:8b:e2
>>> wlan0: authenticate with 90:fb:5d:94:8b:e2 (local address=84:9e:56:9c:7e:6b)
>>> wlan0: send auth to 90:fb:5d:94:8b:e2 (try 1/3)
>>>  slab kmalloc-8k start ffff8c80958a6000 pointer offset 4160 size 8192
>>> list_add corruption. prev->next should be next (ffff8c808a7488f8), but was ffff8c80958a7040. (prev=ffff8c80958a7040).
>>>
>>>  mt76_wcid_add_poll+0x95/0xd0 [mt76]
>>>  mt7925_mac_add_txs.part.0+0xa5/0xe0 [mt7925_common]
>>>  mt7925_rx_check+0xa7/0xc0 [mt7925_common]
>>>  mt76_dma_rx_poll+0x50d/0x790 [mt76]
>>>  mt792x_poll_rx+0x52/0xe0 [mt792x_lib]
>>>
>>> Signed-off-by: Jiajia Liu <liujiajia at kylinos.cn>
>>> ---
>>>
>>> Changes in v2:
>>>   - use dev->wcid table instead of adding MT_WCID_FLAG_DRV_PUBLSH for
>>>     wcid publish check suggested by Sean
>>>   - subject and commit message update
>>>
>>> ---
>>>  drivers/net/wireless/mediatek/mt76/mac80211.c | 15 ++++++++++++---
>>>  1 file changed, 12 insertions(+), 3 deletions(-)
>>>
>>> diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
>>> index 4ae5e4715a9c..b78b4cd206e0 100644
>>> --- a/drivers/net/wireless/mediatek/mt76/mac80211.c
>>> +++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
>>> @@ -1576,6 +1576,7 @@ mt76_sta_add(struct mt76_phy *phy, struct ieee80211_vif *vif,
>>>  {
>>>  	struct mt76_wcid *wcid = (struct mt76_wcid *)sta->drv_priv;
>>>  	struct mt76_dev *dev = phy->dev;
>>> +	struct mt76_wcid *published;
>>>  	int ret;
>>>  	int i;
>>>  
>>> @@ -1595,11 +1596,19 @@ mt76_sta_add(struct mt76_phy *phy, struct ieee80211_vif *vif,
>>>  		mtxq->wcid = wcid->idx;
>>>  	}
>>>  
>>> -	ewma_signal_init(&wcid->rssi);
>>> -	rcu_assign_pointer(dev->wcid[wcid->idx], wcid);
>>> +	published = rcu_dereference_protected(dev->wcid[wcid->idx],
>>> +					      lockdep_is_held(&dev->mutex));
>>> +	if (published != wcid) {
>>> +		WARN_ON_ONCE(published);
>>> +		ewma_signal_init(&wcid->rssi);
>>> +		rcu_assign_pointer(dev->wcid[wcid->idx], wcid);
>>> +		mt76_wcid_init(wcid, phy->band_idx);
>>> +	} else {
>>> +		wcid->phy_idx = phy->band_idx;
>>> +	}
>>> +
>>>  	phy->num_sta++;
>>>  
>>> -	mt76_wcid_init(wcid, phy->band_idx);
>>>  out:
>>>  	mutex_unlock(&dev->mutex);
>>>