[PATCH rtw-next] wifi: rtw89: take the interface off the active list when removing it

[PATCH rtw-next] wifi: rtw89: take the interface off the active list when removing it

[rcfa]

An interface is on the channel manager's active list while one of its
links has a channel context: rtw89_chanctx_ops_assign_vif() adds it, and
rtw89_chanctx_ops_unassign_vif() removes it once no link has one left.
rtw89_ops_remove_interface() does not touch the list, so if mac80211
removes an interface whose links still have channel contexts, the
interface stays on it. The next rtw89_ops_add_interface() then finds the
vif off rtwvifs_list and re-initializes mgnt_entry, which active_list
still points to. The entry now points to itself, and every walk of the
active list loops forever.

mac80211 should not remove an interface in that state, but it can: an
association that completes after cfg80211 has left (NETDEV_GOING_DOWN)
is not torn down before ndo_stop, and ieee80211_do_stop() warns
"destroying interface with valid links" and removes the interface
anyway. That is being fixed in mac80211 separately; rtw89 should not
corrupt its list either way.

This was seen with an RTL8922AU (USB) on Linux 7.1.5 and wpa_supplicant
2.11 associating by MLO, when NetworkManager took the interface down in
the same second as the association completed. After the interface came
back up, wpa_supplicant's next scan spun in rtw89_hw_scan_start() ->
rtw89_hw_scan_set_extra_op_info() at "if (tmp == scan_rtwvif) continue;"
with the wiphy lock held, NetworkManager blocked on it holding RTNL, and
everything that needed RTNL hung until a reboot:

  destroying interface with valid links 0x0002
  WARNING: net/mac80211/iface.c:563 at ieee80211_do_stop+0x9d8/0xb50 [mac80211]
  ...
  rtw89_8922au_git 3-2:1.0: rtw89_ops_remove_interface: rtwvif link (link_id 0) is not active
  ...
  INFO: task NetworkManager:2502 blocked for more than 311 seconds.
  INFO: task NetworkManager:2502 is blocked on a mutex likely owned by task wpa_supplicant:39683.

Take the interface off the active list in rtw89_ops_remove_interface()
if it is still on it, and warn, since its channel contexts were never
unassigned.

Tested on Linux 7.1.5 with the out-of-tree copy of rtw89 at
github.com/morrownr/rtw89, which has the same code in the functions
involved, and an unpatched mac80211 with a test-only hook that ignores
the next
WLAN_REASON_DEAUTH_LEAVING deauthentication from cfg80211, so that an
associated interface taken down is still associated in
ieee80211_do_stop(). The new warning fired, and the next scan after the
interface came back up completed instead of looping. (mac80211 then
went on to oops in the state it was left in, which is the part the
mac80211 fix addresses.)

The problem was found with Claude Code (Claude Opus 5.5) while analysing
that hang, and this change and changelog were written in the same
session.

Fixes: 68ec751b2881 ("wifi: rtw89: chan: manage active interfaces")
Signed-off-by: rcfa <kernel@cubiculum.net>
---

Notes:
    Testing: the results above are from Linux 7.1.5 with the out-of-tree
    copy of the driver. This patch on rtw-next has been compile-tested only:
    x86_64 allmodconfig with gcc 16.2 (CONFIG_WERROR=y), rtw89/ with and
    without W=1, and sparse on mac80211.c, with no new warnings.
    
    The mac80211 side is posted separately, for wireless:
    "wifi: mac80211: deauthenticate on stop if an association just completed"

 drivers/net/wireless/realtek/rtw89/mac80211.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c
index 9e6cafc492c4..c9d9964dd27d 100644
--- a/drivers/net/wireless/realtek/rtw89/mac80211.c
+++ b/drivers/net/wireless/realtek/rtw89/mac80211.c
@@ -269,6 +269,18 @@ static void rtw89_ops_remove_interface(struct ieee80211_hw *hw,
 	rtw89_vif_unset_link(rtwvif, RTW89_VIF_IDLE_LINK_ID);
 
 bottom:
+	/* If mac80211 removes the interface while its links still have channel
+	 * contexts, rtw89_chanctx_ops_unassign_vif() has not taken it off the
+	 * active list. Do it here: add_interface re-initializes mgnt_entry, and
+	 * an entry re-initialized while still linked makes every walk of the
+	 * active list loop forever.
+	 */
+	if (!list_empty(&rtwvif->mgnt_entry)) {
+		rtw89_warn(rtwdev, "%s: interface still in the active list\n",
+			   __func__);
+		list_del_init(&rtwvif->mgnt_entry);
+	}
+
 	list_del_init(&rtwvif->list);
 	rtw89_core_release_bit_map(rtwdev->hw_port, port);
 	rtw89_release_mac_id(rtwdev, macid);

base-commit: 9b0be45d4d52fd223994e151f169743a97abd290
-- 
2.53.0