github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: ath11k: avoid IDR mutation during pending mgmt TX cleanup

Browse Source 
The pending management TX cleanup walks txmgmt_idr with idr_for_each(),
and its callback removes the current entry. This can invalidate the
radix-tree iterator retained by idr_for_each().

Use idr_for_each_entry() so every iteration starts with a fresh lookup.
Continue to remove each entry under txmgmt_idr_lock before freeing its skb,
preventing concurrent TX completion from finding a stale skb pointer.

Fixes: d5c65159f2 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20261003092104.520135-3-yaojiale02@163.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
This commit is contained in:
Jiale Yao 2026-10-03 17:20:59 +08:00 committed by Jeff Johnson
parent 1c1a208e65
commit 3e7f5d362b
3 changed files with 8 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/net/wireless/ath/ath11k/core.c
View File

@ -2448,8 +2448,7 @@ void ath11k_core_pre_reconfigure_recovery(struct ath11k_base *ab)
complete(&ar->thermal.wmi_sync);
wake_up(&ar->dp.tx_empty_waitq);
idr_for_each(&ar->txmgmt_idr,
ath11k_mac_tx_mgmt_pending_free, ar);
ath11k_mac_tx_mgmt_pending_free(ar);
idr_destroy(&ar->txmgmt_idr);
wake_up(&ar->txmgmt_empty_waitq);

12
drivers/net/wireless/ath/ath11k/mac.c
View File

@ -6167,13 +6167,13 @@ static void ath11k_mac_tx_mgmt_free(struct ath11k *ar, int buf_id)
ath11k_mgmt_over_wmi_tx_drop(ar, msdu);
}
int ath11k_mac_tx_mgmt_pending_free(int buf_id, void *skb, void *ctx)
void ath11k_mac_tx_mgmt_pending_free(struct ath11k *ar)
{
struct ath11k *ar = ctx;
struct sk_buff *msdu;
int buf_id;
ath11k_mac_tx_mgmt_free(ar, buf_id);
return 0;
idr_for_each_entry(&ar->txmgmt_idr, msdu, buf_id)
ath11k_mac_tx_mgmt_free(ar, buf_id);
}
static int ath11k_mac_vif_txmgmt_idr_remove(int buf_id, void *skb, void *ctx)
@ -10418,7 +10418,7 @@ static void __ath11k_mac_unregister(struct ath11k *ar)
ieee80211_unregister_hw(ar->hw);
idr_for_each(&ar->txmgmt_idr, ath11k_mac_tx_mgmt_pending_free, ar);
ath11k_mac_tx_mgmt_pending_free(ar);
idr_destroy(&ar->txmgmt_idr);
kfree(ar->mac.sbands[NL80211_BAND_2GHZ].channels);

2
drivers/net/wireless/ath/ath11k/mac.h
View File

@ -162,7 +162,7 @@ struct ath11k *ath11k_mac_get_ar_by_pdev_id(struct ath11k_base *ab, u32 pdev_id)
void ath11k_mac_drain_tx(struct ath11k *ar);
void ath11k_mac_peer_cleanup_all(struct ath11k *ar);
int ath11k_mac_tx_mgmt_pending_free(int buf_id, void *skb, void *ctx);
void ath11k_mac_tx_mgmt_pending_free(struct ath11k *ar);
u8 ath11k_mac_bw_to_mac80211_bw(u8 bw);
enum nl80211_he_gi ath11k_mac_he_gi_to_nl80211_he_gi(u8 sgi);
enum nl80211_he_ru_alloc ath11k_mac_phy_he_ru_to_nl80211_he_ru_alloc(u16 ru_phy);