wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work

The mt7921_set_roc API may be executed concurrently with mt7921_roc_work,
specifically between the following code paths:

- The check and clear of MT76_STATE_ROC in mt7921_roc_work:
    if (!test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state))
        return;

- The execution of ieee80211_iterate_active_interfaces.

This race condition can interrupt the ROC abort flow, resulting in
the ROC process failing to abort as expected.

To address this defect, the modification of MT76_STATE_ROC is now
protected by mt792x_mutex_acquire(phy->dev). This ensures that
changes to the ROC state are properly synchronized, preventing
race conditions and ensuring the ROC abort flow is not interrupted.

Fixes: 034ae28b56f1 ("wifi: mt76: mt7921: introduce remain_on_channel support")
Cc: stable@vger.kernel.org
Signed-off-by: Quan Zhou <quan.zhou@mediatek.com>
Reviewed-by: Sean Wang <sean.wang@mediatek.com>
Link: https://patch.msgid.link/2568ece8b557e5dda79391414c834ef3233049b6.1769133724.git.quan.zhou@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
index debecd3dff751cb73c0d9583a82d044e849234b0..f42e40f9663d8e03303a7b72c7c60c2ff6fdcce9 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
@@ -387,10 +387,11 @@ void mt7921_roc_work(struct work_struct *work)
        phy = (struct mt792x_phy *)container_of(work, struct mt792x_phy,
                                                roc_work);
 
-       if (!test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state))
-               return;
-
        mt792x_mutex_acquire(phy->dev);
+       if (!test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state)) {
+               mt792x_mutex_release(phy->dev);
+               return;
+       }
        ieee80211_iterate_active_interfaces(phy->mt76->hw,
                                            IEEE80211_IFACE_ITER_RESUME_ALL,
                                            mt7921_roc_iter, phy);