mt76: fix aggregation stop issue

Cancel the workqueue after the tid has been cleaned up, in order to
avoid a possible rescheduling from within the work function.

Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/drivers/net/wireless/mediatek/mt76/agg-rx.c b/drivers/net/wireless/mediatek/mt76/agg-rx.c
index b05d439dca3b89bcf95ce581a2d93805507cea02..53b5a4b2dcc5049c6cb4d42e3571b532cd5a7071 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/agg-rx.c
+++ b/drivers/net/wireless/mediatek/mt76/agg-rx.c
@@ -130,8 +130,10 @@ mt76_rx_aggr_check_ctl(struct sk_buff *skb, struct sk_buff_head *frames)
                return;
 
        spin_lock_bh(&tid->lock);
-       mt76_rx_aggr_release_frames(tid, frames, seqno);
-       mt76_rx_aggr_release_head(tid, frames);
+       if (!tid->stopped) {
+               mt76_rx_aggr_release_frames(tid, frames, seqno);
+               mt76_rx_aggr_release_head(tid, frames);
+       }
        spin_unlock_bh(&tid->lock);
 }
 
@@ -257,8 +259,6 @@ static void mt76_rx_aggr_shutdown(struct mt76_dev *dev, struct mt76_rx_tid *tid)
        u8 size = tid->size;
        int i;
 
-       cancel_delayed_work_sync(&tid->reorder_work);
-
        spin_lock_bh(&tid->lock);
 
        tid->stopped = true;
@@ -273,6 +273,8 @@ static void mt76_rx_aggr_shutdown(struct mt76_dev *dev, struct mt76_rx_tid *tid)
        }
 
        spin_unlock_bh(&tid->lock);
+
+       cancel_delayed_work_sync(&tid->reorder_work);
 }
 
 void mt76_rx_aggr_stop(struct mt76_dev *dev, struct mt76_wcid *wcid, u8 tidno)