linux-kernel - [PATCH v2 0/6] wifi: mt76: mt7925/mt792x: additional stability fixes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260102200315.290015-1-zbowling@gmail.com>
Date: Fri,  2 Jan 2026 12:03:09 -0800
From: Zac Bowling <zbowling@...il.com>
To: zbowling@...il.com
Cc: deren.wu@...iatek.com,
	kvalo@...nel.org,
	linux-kernel@...r.kernel.org,
	linux-mediatek@...ts.infradead.org,
	linux-wireless@...r.kernel.org,
	lorenzo@...nel.org,
	nbd@....name,
	ryder.lee@...iatek.com,
	sean.wang@...iatek.com
Subject: [PATCH v2 0/6] wifi: mt76: mt7925/mt792x: additional stability fixes

From: Zac Bowling <zac@...bowling.com>

This series contains additional fixes for the MT7925 WiFi driver that
address issues discovered through further testing and static analysis.
These patches build on my previous series [1] and address the remaining
stability issues I've encountered on the Framework Desktop.

Changes since v1:
- 6 new patches addressing MLO roaming, firmware recovery, and resume path

Summary of fixes:

Patch 12: Fix key removal failure during MLO roaming
  During MLO link teardown, mac80211 may request key removal after
  driver state is already cleaned up. Return success instead of -EINVAL
  when the link is already gone, as the key is effectively removed.

Patch 13: Fix kernel warning in MLO ROC setup
  Replace WARN_ON_ONCE() with proper NULL checks in mt7925_mcu_set_mlo_roc().
  During MLO AP setup, the channel may not be configured yet when this
  function is called. Return -ENOLINK instead of triggering a warning.

Patch 14: Add NULL checks for MLO link pointers in MCU functions
  Several MCU functions dereference mt792x_sta_to_link() and
  mt792x_vif_to_link() without checking for NULL. Add defensive checks
  in sta_hdr_trans_tlv, wtbl_update_hdr_trans, sta_amsdu_tlv,
  sta_mld_tlv, and sta_update.

Patch 15: Fix firmware reload after previous load crash (mt792x)
  Backport the MT7915 fix (commit 79dd14f) to MT792x. If firmware loading
  crashes after acquiring the patch semaphore, subsequent loads fail with
  "Failed to get patch semaphore". Release the semaphore and restart MCU
  before loading to ensure clean state.

Patch 16: Add mutex protection in resume path
  The resume path was missing mutex protection around mt7925_mcu_set_deep_sleep()
  and mt7925_regd_update() calls. Found by static analysis (sparse/coccinelle).

Patch 17: Add NULL checks and error handling
  Add NULL checks in mt7925_mac_link_sta_add() and mt7925_conf_tx().
  Add error logging for MCU calls in mt7925_regd_update() to help
  diagnose regulatory domain update failures.

These fixes have been tested on a Framework Desktop (AMD Ryzen AI Max 300)
with the MT7925 (RZ717) WiFi card. The system is now stable through
suspend/resume cycles, MLO roaming, and firmware recovery scenarios that
previously caused crashes or hangs.

[1] https://lore.kernel.org/all/20260101062543.186499-1-zbowling@gmail.com/

Zac Bowling (6):
  wifi: mt76: mt7925: fix key removal failure during MLO roaming
  wifi: mt76: mt7925: fix kernel warning in MLO ROC setup
  wifi: mt76: mt7925: add NULL checks for MLO link pointers in MCU
  wifi: mt76: mt792x: fix firmware reload after failed load
  wifi: mt76: mt7925: add mutex protection in resume path
  wifi: mt76: mt7925: add NULL checks and error handling

 drivers/net/wireless/mediatek/mt76/mt7925/init.c |  13 ++-
 drivers/net/wireless/mediatek/mt76/mt7925/main.c |  19 +++-
 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c  |  45 +++++---
 drivers/net/wireless/mediatek/mt76/mt7925/pci.c  |   2 +
 drivers/net/wireless/mediatek/mt76/mt792x_core.c |  14 +++
 5 files changed, 75 insertions(+), 18 deletions(-)

-- 
2.43.0