mac80211 does not call remove_interface() after add_interface() fails, so the driver must undo any state it published before returning an error. mm81x_mac_ops_add_interface() publishes the vif through the RCU-protected vif table and initializes AP beacon handling before querying firmware capabilities. If that query fails, the published pointer remains after mac80211 frees the vif. Interrupt processing can then retrieve and dereference the stale vif. Finish AP beacon handling, clear the RCU slot, and ask the firmware to remove the interface when the capabilities query fails. Preserve the original query error if firmware cleanup also fails. Commit 2fb6480c52f6 ("wifi: mt76: mt7915: unwind state on add_interface failure") fixed the same failure-unwind pattern in another wireless driver. Fixes: b1906cea00b0 ("wifi: mm81x: add mm81x Wi-Fi HaLow driver") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao --- drivers/net/wireless/morsemicro/mm81x/mac.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/morsemicro/mm81x/mac.c b/drivers/net/wireless/morsemicro/mm81x/mac.c index 0fa80b1488aa..1edad7eace61 100644 --- a/drivers/net/wireless/morsemicro/mm81x/mac.c +++ b/drivers/net/wireless/morsemicro/mm81x/mac.c @@ -2169,7 +2169,7 @@ static int mm81x_mac_restart(struct mm81x *mors) static int mm81x_mac_ops_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif) { - int ret = 0; + int cleanup_ret, ret = 0; struct mm81x *mors = hw->priv; struct mm81x_vif *mors_vif = (struct mm81x_vif *)vif->drv_priv; @@ -2221,6 +2221,13 @@ static int mm81x_mac_ops_add_interface(struct ieee80211_hw *hw, dev_err(mors->dev, "mm81x_cmd_get_capabilities failed for vif %d", mors_vif->id); + if (vif->type == NL80211_IFTYPE_AP) + mm81x_mac_beacon_finish(mors_vif); + RCU_INIT_POINTER(mors->vifs[mors_vif->id], NULL); + cleanup_ret = mm81x_cmd_rm_if(mors, mors_vif->id); + if (cleanup_ret) + dev_err(mors->dev, "mm81x_cmd_rm_if failed %d", + cleanup_ret); return ret; } -- 2.34.1