wifi: mt76: mt7925: fix locking in mt7925_change_vif_links()

[ Upstream commit 9f15701370ec15fbf1f6a1cbbf584b0018d036b5 ]

&dev->mt76.mutex lock is taken using mt792x_mutex_acquire(dev) but not
released in one of the error paths, add the unlock to fix it.

Fixes: 5cd0bd815c8a ("wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202503031055.3ZRqxhAl-lkp@intel.com/
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Link: https://patch.msgid.link/20250727140416.1153406-1-harshit.m.mogalapalli@oracle.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
index a635b223dab18ee94e3c7c4dcb1e6673867e3078..53831e1e0042404b2e41aea2d3fc5d3ca4fca49a 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
@@ -2005,8 +2005,10 @@ mt7925_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                                             GFP_KERNEL);
                        mlink = devm_kzalloc(dev->mt76.dev, sizeof(*mlink),
                                             GFP_KERNEL);
-                       if (!mconf || !mlink)
+                       if (!mconf || !mlink) {
+                               mt792x_mutex_release(dev);
                                return -ENOMEM;
+                       }
                }
 
                mconfs[link_id] = mconf;