linux-kernel - Re: [PATCH] wifi: mt76: add missing lock protection in mt76_sta_state for sta

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGp9LzqQ45LAeeG1Cijs1QmtzBjOmML_qY=9Y5zH8tYmZeQWZQ@mail.gmail.com>
Date: Fri, 30 Jan 2026 19:36:56 -0600
From: Sean Wang <sean.wang@...nel.org>
To: Ziyi Guo <n7l8m4@...orthwestern.edu>
Cc: Felix Fietkau <nbd@....name>, Lorenzo Bianconi <lorenzo@...nel.org>, Ryder Lee <ryder.lee@...iatek.com>, 
	Shayne Chen <shayne.chen@...iatek.com>, Sean Wang <sean.wang@...iatek.com>, 
	Matthias Brugger <matthias.bgg@...il.com>, 
	AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>, linux-wireless@...r.kernel.org, 
	linux-kernel@...r.kernel.org, linux-mediatek@...ts.infradead.org, 
	linux-arm-kernel@...ts.infradead.org
Subject: Re: [PATCH] wifi: mt76: add missing lock protection in mt76_sta_state
 for sta_event callback

On Thu, Jan 29, 2026 at 9:25 PM Ziyi Guo <n7l8m4@...orthwestern.edu> wrote:
>
> mt76_sta_state() calls the sta_event callback without holding dev->mutex.
> However, mt7915_mac_sta_event() (MT7915 implementation of this callback)
> calls mt7915_mac_twt_teardown_flow() which has
> lockdep_assert_held(&dev->mt76.mutex) indicating that callers must
> hold this lock.
>
> The locking pattern in mt76_sta_state() is inconsistent:
> - mt76_sta_add() acquires dev->mutex before calling dev->drv->sta_add
> - mt76_sta_remove() acquires dev->mutex before calling __mt76_sta_remove
> - But sta_event callback is called without acquiring the lock
>
> Add mutex_lock()/mutex_unlock() around the sta_event callback invocation
> to fix the missing lock protection and maintain consistency with the
> existing locking pattern.
>

The mt7921 / mt7925 .sta_event callback already holds the lock; this
patch would cause a deadlock. Suggest adding the implementation to
MT7915.

> Signed-off-by: Ziyi Guo <n7l8m4@...orthwestern.edu>
> ---
>  drivers/net/wireless/mediatek/mt76/mac80211.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
> index 75772979f438..468bc176bacb 100644
> --- a/drivers/net/wireless/mediatek/mt76/mac80211.c
> +++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
> @@ -1640,6 +1640,7 @@ int mt76_sta_state(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
>         struct mt76_phy *phy = hw->priv;
>         struct mt76_dev *dev = phy->dev;
>         enum mt76_sta_event ev;
> +       int ret;
>
>         phy = mt76_vif_phy(hw, vif);
>         if (!phy)
> @@ -1668,7 +1669,11 @@ int mt76_sta_state(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
>         else
>                 return 0;
>
> -       return dev->drv->sta_event(dev, vif, sta, ev);
> +       mutex_lock(&dev->mutex);
> +       ret = dev->drv->sta_event(dev, vif, sta, ev);
> +       mutex_unlock(&dev->mutex);
> +
> +       return ret;
>  }
>  EXPORT_SYMBOL_GPL(mt76_sta_state);
>
> --
> 2.34.1
>
>