[PATCH wireless-next 0/2] wifi: nxpwifi: fix sta_list locking and the deauth leak

Two fixes for priv->sta_list in the uAP path, both found by reading the
station list locking model rather than from a report.

Patch 1 restores the writer lock in nxpwifi_del_sta_entry().  The list
has three writers; two of them take sta_list_spinlock, the third relies
on the cfg80211 mutex instead.  That mutex does not cover the other two,
because they run from firmware events on the driver's main work queue,
which never takes the wiphy lock.

Patch 2 deletes the station entry when the firmware reports
EVENT_UAP_STA_DEAUTH.  Nothing removes it today, so a station that has
left stays on the list until the BSS goes idle, and frames addressed to
it are requeued as intra-BSS traffic instead of going up the stack.

The order matters.  Patch 2 adds a second caller of
nxpwifi_del_sta_entry(), and that caller runs on the main work queue.
With patch 1 in front of it the two deletion paths serialise on
sta_list_spinlock and only one of them unlinks the node; the other
finds nothing and returns.  Applied the other way round, patch 2 would
widen the race that patch 1 fixes.

Neither patch has been tested on hardware -- I have no IW61x.  Both are
derived from the code paths, and both restore behaviour that mwifiex,
which nxpwifi was derived from, already has.

Linmao Li (2):
  wifi: nxpwifi: protect sta_list against concurrent add and delete
  wifi: nxpwifi: delete the station entry on the uAP deauth event

 drivers/net/wireless/nxp/nxpwifi/cfg80211.c  | 2 ++
 drivers/net/wireless/nxp/nxpwifi/uap_event.c | 1 +
 drivers/net/wireless/nxp/nxpwifi/util.c      | 8 ++++++--
 3 files changed, 9 insertions(+), 2 deletions(-)

-- 
2.25.1