From: Jiale Yao <hidden> Date: 2026-09-24 13:20:16
mac80211 does not call remove_interface() when a driver's
add_interface() callback fails. Drivers must therefore unwind all state
they published before returning the error.
Four wireless drivers leave vif pointers or resource reservations behind
when a firmware operation fails during interface creation. Depending on
the driver, later RX, interrupt, or testmode paths can dereference the stale
vif, and leaked mask bits or counters can prevent subsequent interfaces
from being created.
Unwind the state at each failure point, following the approach used by
commit 2fb6480c52f6 ("wifi: mt76: mt7915: unwind state on add_interface
failure"). Each patch is independent and addresses one driver.
These paths were reviewed against the driver state transitions and their
remove_interface() counterparts.
Jiale Yao (4):
wifi: mt76: mt7615: unwind add_interface failures
wifi: mt76: mt7925: unwind link BSS add failures
wifi: rsi: unwind add_interface failure
wifi: mm81x: unwind add_interface failure
.../net/wireless/mediatek/mt76/mt7615/main.c | 19 ++++++++++++++++++-
.../net/wireless/mediatek/mt76/mt7925/main.c | 4 +++-
drivers/net/wireless/morsemicro/mm81x/mac.c | 9 ++++++++-
drivers/net/wireless/rsi/rsi_91x_mac80211.c | 2 ++
4 files changed, 31 insertions(+), 3 deletions(-)
--
2.34.1
From: Jiale Yao <hidden> Date: 2026-09-24 13:20:04
mac80211 does not call remove_interface() after add_interface() fails, so
the driver must undo any state it published before returning an error.
mt7925_mac_link_bss_add() reserves vif and OMAC bits and publishes the
station WCID before asking the firmware to add the device. If that command
fails, the function currently returns with those resources still installed.
The WCID pointer then refers into vif private data that mac80211 can free,
and the mask bits remain permanently allocated.
Use the existing link BSS removal helper to undo the published WCID, mask
bits, and WCID resources when the firmware add command fails.
Commit 2fb6480c52f6 ("wifi: mt76: mt7915: unwind state on add_interface
failure") fixed the same failure-unwind issue in mt7915.
Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <redacted>
---
drivers/net/wireless/mediatek/mt76/mt7925/main.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
From: Jiale Yao <hidden> Date: 2026-09-24 13:20:18
mac80211 does not call remove_interface() after add_interface() fails, so
the driver must undo any state it published before returning an error.
mt7615_add_interface() records a monitor vif before resource allocation,
and later reserves vif and OMAC bits and publishes the station WCID. An
allocation or firmware failure leaves some or all of that state behind.
The stale monitor_vif can then be used by the testmode transmit path after
mac80211 frees the vif, while the leaked mask bits permanently consume
interface resources.
Unpublish the WCID and release its resources when adding device information
fails, clear the reserved mask bits after failures that occur after their
allocation, and clear monitor_vif on every failed add.
Commit 2fb6480c52f6 ("wifi: mt76: mt7915: unwind state on add_interface
failure") fixed the same failure-unwind issue in mt7915.
Fixes: 4f0bce1c8888 ("mt76: mt7615: implement testmode support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <redacted>
---
.../net/wireless/mediatek/mt76/mt7615/main.c | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
From: Jiale Yao <hidden> Date: 2026-09-24 13:20:26
mac80211 does not call remove_interface() after add_interface() fails, so
the driver must undo any state it published before returning an error.
mm81x_mac_ops_add_interface() publishes the vif through the RCU-protected
vif table and initializes AP beacon handling before querying firmware
capabilities. If that query fails, the published pointer remains after
mac80211 frees the vif. Interrupt processing can then retrieve and
dereference the stale vif.
Finish AP beacon handling, clear the RCU slot, and ask the firmware to
remove the interface when the capabilities query fails. Preserve the
original query error if firmware cleanup also fails.
Commit 2fb6480c52f6 ("wifi: mt76: mt7915: unwind state on add_interface
failure") fixed the same failure-unwind pattern in another wireless driver.
Fixes: b1906cea00b0 ("wifi: mm81x: add mm81x Wi-Fi HaLow driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <redacted>
---
drivers/net/wireless/morsemicro/mm81x/mac.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
From: Jiale Yao <hidden> Date: 2026-09-24 13:20:27
mac80211 does not call remove_interface() after add_interface() fails, so
the driver must undo any state it published before returning an error.
rsi_mac80211_add_interface() stores the vif in adapter->vifs[] and
increments sc_nvifs before sending the VAP capabilities command. If that
command fails, the function returns without undoing either update. The
array entry can therefore refer to vif memory freed by mac80211, while the
interface count remains inflated.
Clear the vif slot and restore sc_nvifs when setting VAP capabilities
fails, mirroring the state cleanup in remove_interface().
Commit 2fb6480c52f6 ("wifi: mt76: mt7915: unwind state on add_interface
failure") fixed the same failure-unwind pattern in another wireless driver.
Fixes: b8bd3a439f35 ("rsi: add/remove interface enhancements for p2p")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <redacted>
---
drivers/net/wireless/rsi/rsi_91x_mac80211.c | 2 ++
1 file changed, 2 insertions(+)
@@ -518,6 +518,8 @@ static int rsi_mac80211_add_interface(struct ieee80211_hw *hw,if(rsi_set_vap_capabilities(common,intf_mode,vif->addr,vif_info->vap_id,vap_status)){rsi_dbg(ERR_ZONE,"Failed to set VAP capabilities\n");+adapter->vifs[vap_idx]=NULL;+adapter->sc_nvifs--;mutex_unlock(&common->mutex);return-EINVAL;}