[PATCH 3/4] wifi: rsi: unwind add_interface failure

[Jiale Yao]

mac80211 does not call remove_interface() after add_interface() fails, so
the driver must undo any state it published before returning an error.

rsi_mac80211_add_interface() stores the vif in adapter->vifs[] and
increments sc_nvifs before sending the VAP capabilities command.  If that
command fails, the function returns without undoing either update.  The
array entry can therefore refer to vif memory freed by mac80211, while the
interface count remains inflated.

Clear the vif slot and restore sc_nvifs when setting VAP capabilities
fails, mirroring the state cleanup in remove_interface().

Commit 2fb6480c52f6 ("wifi: mt76: mt7915: unwind state on add_interface
failure") fixed the same failure-unwind pattern in another wireless driver.

Fixes: b8bd3a439f35 ("rsi: add/remove interface enhancements for p2p")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 drivers/net/wireless/rsi/rsi_91x_mac80211.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
index 3faf2235728b..34ddcbc43fdc 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
@@ -518,6 +518,8 @@ static int rsi_mac80211_add_interface(struct ieee80211_hw *hw,
 	if (rsi_set_vap_capabilities(common, intf_mode, vif->addr,
 				     vif_info->vap_id, vap_status)) {
 		rsi_dbg(ERR_ZONE, "Failed to set VAP capabilities\n");
+		adapter->vifs[vap_idx] = NULL;
+		adapter->sc_nvifs--;
 		mutex_unlock(&common->mutex);
 		return -EINVAL;
 	}
-- 
2.34.1