[PATCH 2/2] wifi: mt76: skip NAPI deletion for WED RRO queues

[Goliath Zhu]

Commit 6b470f36616e ("wifi: mt76: Fix memory leak destroying device")
made mt76_dma_cleanup() visit WED RRO queues so that their page pools
are destroyed during device removal.

When WED is active, mt76 does not register NAPI for these queues.
Calling netif_napi_del() on their uninitialized napi_struct can
dereference a NULL napi->dev.

Keep cleaning the RX queue and destroying its page pool, only call
netif_napi_del() for queues which have an mt76 NAPI instance.

Fixes: 6b470f36616e ("wifi: mt76: Fix memory leak destroying device")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Goliath Zhu <goliath.zhu@xxxxxxxxxxxx>
---
 drivers/net/wireless/mediatek/mt76/dma.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
index f8c2fe5f2..ddcfb9e46 100644
--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -1189,7 +1189,9 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
 	mt76_for_each_q_rx(dev, i) {
 		struct mt76_queue *q = &dev->q_rx[i];
 
-		netif_napi_del(&dev->napi[i]);
+		if (!mtk_wed_device_active(&dev->mmio.wed) ||
+		    !mt76_queue_is_wed_rro(q))
+			netif_napi_del(&dev->napi[i]);
 		mt76_dma_rx_cleanup(dev, q);
 
 		page_pool_destroy(q->page_pool);
-- 
2.55.0