mt76: fix race condition in station removal
authorFelix Fietkau <nbd@nbd.name>
Tue, 13 Nov 2018 10:25:47 +0000 (11:25 +0100)
committerFelix Fietkau <nbd@nbd.name>
Fri, 30 Nov 2018 11:29:34 +0000 (12:29 +0100)
commitc2a1a5e13684cafb866f15af2394119f62c423a9
tree0a03c3479caa80fb709c9eb2448d8eef2da493ec
parent13c6d5f8370a55f556443e32c314f8b3abf842ad
mt76: fix race condition in station removal

If there are still pending packets in the tx queue when removing a station,
it could possibly lead to a call to further attempts to pull packets from
the mac80211 tx queue after it has already been removed from the scheduling
list.
Prevent this from happening by calling synchronize_rcu after deleting the
wcid pointer before further cleaning up the tx queues.
To be extra careful, ensure that mtxq->list is always initialized properly.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
drivers/net/wireless/mediatek/mt76/mt76x02_util.c
drivers/net/wireless/mediatek/mt76/tx.c