From: Felix Fietkau <nbd@nbd.name>
To: linux-wireless@vger.kernel.org
Subject: [PATCH mt76-next 09/29] wifi: mt76: mt7996: don't leak MLD group index on remap alloc failure
Date: Fri, 24 Jul 2026 12:47:53 +0000 [thread overview]
Message-ID: <20260724124813.3961474-9-nbd@nbd.name> (raw)
In-Reply-To: <20260724124813.3961474-1-nbd@nbd.name>
mt7996_change_vif_links() sets the mld_idx_mask group bit before
allocating the remap index. If the remap allocation fails it jumped to
the exit without clearing that bit, permanently consuming one of the 16
MLD group slots. Release the group bit on the error path.
Fixes: 4fb3b4e7d1ca ("wifi: mt76: mt7996: fix MLD group index assignment")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
drivers/net/wireless/mediatek/mt76/mt7996/main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index 2487b00c3790..57afe4e81666 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -2458,6 +2458,7 @@ mt7996_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
idx = get_free_idx(dev->mld_remap_idx_mask, 0, 15) - 1;
if (idx < 0) {
+ dev->mld_idx_mask &= ~BIT_ULL(mvif->mld_group_idx);
ret = -ENOSPC;
goto out;
}
--
2.53.0
next prev parent reply other threads:[~2026-07-24 12:48 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-24 12:47 [PATCH mt76-next 01/29] wifi: mt76: fix HE DCM max-RU capability encoding Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 02/29] wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 03/29] wifi: mt76: fix out-of-bounds access in mmio copy helpers Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 04/29] wifi: mt76: mt7915: unwind state on add_interface failure Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 05/29] wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 06/29] wifi: mt76: decode the full VHT Rx STBC capability field Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 07/29] wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 08/29] wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV Felix Fietkau
2026-07-24 12:47 ` Felix Fietkau [this message]
2026-07-24 12:47 ` [PATCH mt76-next 10/29] wifi: mt76: cancel reset and rc work on device unregister Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 11/29] wifi: mt76: report data NSS for STBC frames in RX rate decode Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 12/29] wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 13/29] wifi: mt76: mt7996: add missing rdd_idx check when enabling background radar Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 14/29] wifi: mt76: only consume the WO drop bit on WED v2 devices Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 15/29] wifi: mt76: mt7996: add mcu command to set bssid mapping address Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 16/29] wifi: mt76: mt7996: leave PS when a 4-address connection is established Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 17/29] wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 18/29] wifi: mt76: mt7996: skip key upload when adding an offchannel link Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 19/29] wifi: mt76: mt7996: wake MCU waiters before aborting scan in L1 SER Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 20/29] wifi: mt76: fix queue reg access when building WED and NPU together Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 21/29] wifi: mt76: mt7996: select net_setup_tc handler at runtime Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 22/29] wifi: mt76: fix stuck TX queues after SER with no active interfaces Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 23/29] wifi: mt76: mt7615: fix NULL deref in mt7615_mac_set_rates Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 24/29] mt76: mt7915: trigger L1 SER on PLE MDP RIOC hang Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 25/29] wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 26/29] wifi: mt76: mt7996: clear stale link state " Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 27/29] wifi: mt76: set MT76_SCANNING when starting a hw scan Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 28/29] wifi: mt76: serialize scan-link teardown with dev->mutex Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 29/29] wifi: mt76: mt7996: hold dev->mutex in remove_interface teardown Felix Fietkau
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260724124813.3961474-9-nbd@nbd.name \
--to=nbd@nbd.name \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox