mt76_reset_device() tears down each wcid's pktid idr before clearing dev->wcid[i], which is the reverse of the ordering used on the sta removal path. Until the pointer is cleared, a concurrent lookup under status_lock can still find the wcid and access its already destroyed idr. Clear dev->wcid[i] before calling mt76_wcid_cleanup(), reproducing the ordering mac80211 already enforces for normal sta removal (where mt76_sta_pre_rcu_remove() clears dev->wcid[idx] before mt76_wcid_cleanup() runs via the .sta_state callback). Fixes: 065c79df595a ("wifi: mt76: mt7915: fix list corruption after hardware restart") Signed-off-by: Ryan Leung --- drivers/net/wireless/mediatek/mt76/mac80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c index abbe65cbcd89..0eb021be837a 100644 --- a/drivers/net/wireless/mediatek/mt76/mac80211.c +++ b/drivers/net/wireless/mediatek/mt76/mac80211.c @@ -856,8 +856,8 @@ void mt76_reset_device(struct mt76_dev *dev) continue; wcid->sta = 0; - mt76_wcid_cleanup(dev, wcid); rcu_assign_pointer(dev->wcid[i], NULL); + mt76_wcid_cleanup(dev, wcid); } rcu_read_unlock(); --- base-commit: ca800a9302764c445de0da0e84d2252400a770ee change-id: 20260821-mt76-wcid-null-before-cleanup-cdb4d640f7de Best regards, -- Ryan Leung