From 097cc8762da824dcb527167f2c6162334bb51321 Mon Sep 17 00:00:00 2001 From: Zac Bowling Date: Wed, 31 Dec 2025 17:23:50 -0800 Subject: [PATCH 1/3] wifi: mt76: mt7925: add error handling for AMPDU MCU commands Check return values of mt7925_mcu_uni_rx_ba() and mt7925_mcu_uni_tx_ba() in mt7925_ampdu_action() and propagate errors to the caller. Previously, failures in these MCU commands were silently ignored, which could leave block aggregation in an inconsistent state between the driver and firmware. For IEEE80211_AMPDU_TX_STOP_CONT, only call the completion callback ieee80211_stop_tx_ba_cb_irqsafe() if the MCU command succeeded, to avoid signaling completion when the firmware operation failed. Reported-by: Zac Bowling Signed-off-by: Zac Bowling --- mt7925/main.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/mt7925/main.c b/mt7925/main.c index 307850a58..56c6372d6 100644 --- a/mt7925/main.c +++ b/mt7925/main.c @@ -1255,22 +1255,22 @@ mt7925_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif, case IEEE80211_AMPDU_RX_START: mt76_rx_aggr_start(&dev->mt76, &msta->deflink.wcid, tid, ssn, params->buf_size); - mt7925_mcu_uni_rx_ba(dev, params, true); + ret = mt7925_mcu_uni_rx_ba(dev, params, true); break; case IEEE80211_AMPDU_RX_STOP: mt76_rx_aggr_stop(&dev->mt76, &msta->deflink.wcid, tid); - mt7925_mcu_uni_rx_ba(dev, params, false); + ret = mt7925_mcu_uni_rx_ba(dev, params, false); break; case IEEE80211_AMPDU_TX_OPERATIONAL: mtxq->aggr = true; mtxq->send_bar = false; - mt7925_mcu_uni_tx_ba(dev, params, true); + ret = mt7925_mcu_uni_tx_ba(dev, params, true); break; case IEEE80211_AMPDU_TX_STOP_FLUSH: case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT: mtxq->aggr = false; clear_bit(tid, &msta->deflink.wcid.ampdu_state); - mt7925_mcu_uni_tx_ba(dev, params, false); + ret = mt7925_mcu_uni_tx_ba(dev, params, false); break; case IEEE80211_AMPDU_TX_START: set_bit(tid, &msta->deflink.wcid.ampdu_state); @@ -1279,8 +1279,9 @@ mt7925_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif, case IEEE80211_AMPDU_TX_STOP_CONT: mtxq->aggr = false; clear_bit(tid, &msta->deflink.wcid.ampdu_state); - mt7925_mcu_uni_tx_ba(dev, params, false); - ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid); + ret = mt7925_mcu_uni_tx_ba(dev, params, false); + if (!ret) + ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid); break; } mt792x_mutex_release(dev); From 909db0d1b67a24b155f2b5d1748874cf9c7666b3 Mon Sep 17 00:00:00 2001 From: Zac Bowling Date: Wed, 31 Dec 2025 17:23:56 -0800 Subject: [PATCH 2/3] wifi: mt76: mt7925: add error handling for BSS info MCU command in sta_add Check return value of mt7925_mcu_add_bss_info() in mt7925_mac_link_sta_add() and propagate errors to the caller. BSS info must be set up before adding a station record. If this MCU command fails, continuing with station add would leave the firmware in an inconsistent state with a station but no BSS configuration. Reported-by: Zac Bowling Signed-off-by: Zac Bowling --- mt7925/main.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/mt7925/main.c b/mt7925/main.c index 56c6372d6..6228b1260 100644 --- a/mt7925/main.c +++ b/mt7925/main.c @@ -891,11 +891,14 @@ static int mt7925_mac_link_sta_add(struct mt76_dev *mdev, /* should update bss info before STA add */ if (vif->type == NL80211_IFTYPE_STATION && !link_sta->sta->tdls) { if (ieee80211_vif_is_mld(vif)) - mt7925_mcu_add_bss_info(&dev->phy, mconf->mt76.ctx, - link_conf, link_sta, link_sta != mlink->pri_link); + ret = mt7925_mcu_add_bss_info(&dev->phy, mconf->mt76.ctx, + link_conf, link_sta, + link_sta != mlink->pri_link); else - mt7925_mcu_add_bss_info(&dev->phy, mconf->mt76.ctx, - link_conf, link_sta, false); + ret = mt7925_mcu_add_bss_info(&dev->phy, mconf->mt76.ctx, + link_conf, link_sta, false); + if (ret) + return ret; } if (ieee80211_vif_is_mld(vif) && From 8851d75c83f56d4f3e7263b2378783028af70a78 Mon Sep 17 00:00:00 2001 From: Zac Bowling Date: Wed, 31 Dec 2025 17:24:03 -0800 Subject: [PATCH 3/3] wifi: mt76: mt7925: add error handling for BSS info in key setup Check return value of mt7925_mcu_add_bss_info() in mt7925_set_key_link() when setting up cipher for the first time and propagate errors. The BSS info update with cipher information must succeed before key programming can proceed. If this MCU command fails, continuing with key setup would program keys into the firmware for a BSS that doesn't have the correct cipher configuration. Reported-by: Zac Bowling Signed-off-by: Zac Bowling --- mt7925/main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/mt7925/main.c b/mt7925/main.c index 6228b1260..b2ca4ac0e 100644 --- a/mt7925/main.c +++ b/mt7925/main.c @@ -633,8 +633,10 @@ static int mt7925_set_link_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, struct mt792x_phy *phy = mt792x_hw_phy(hw); mconf->mt76.cipher = mt7925_mcu_get_cipher(key->cipher); - mt7925_mcu_add_bss_info(phy, mconf->mt76.ctx, link_conf, - link_sta, true); + err = mt7925_mcu_add_bss_info(phy, mconf->mt76.ctx, link_conf, + link_sta, true); + if (err) + goto out; } if (cmd == SET_KEY)