github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: ath12k: avoid IDR mutation during pending mgmt TX cleanup

Browse Source 
The pending management TX cleanup walks txmgmt_idr with idr_for_each(),
and its callback removes the current entry. This can invalidate the
radix-tree iterator retained by idr_for_each().

Use idr_for_each_entry() so every iteration starts with a fresh lookup.
Continue to remove each entry under txmgmt_idr_lock before freeing its skb,
preventing concurrent TX completion from finding a stale skb pointer.

Fixes: d889913205 ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20261003092104.520135-5-yaojiale02@163.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
This commit is contained in:
Jiale Yao 2026-10-03 17:21:01 +08:00 committed by Jeff Johnson
parent dc29226dad
commit 94c7b50351
3 changed files with 8 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/net/wireless/ath/ath12k/core.c
View File

@ -1571,8 +1571,7 @@ static void ath12k_core_pre_reconfigure_recovery(struct ath12k_base *ab)
complete_all(&ar->thermal.wmi_sync);
wake_up(&ar->dp.tx_empty_waitq);
idr_for_each(&ar->txmgmt_idr,
ath12k_mac_tx_mgmt_pending_free, ar);
ath12k_mac_tx_mgmt_pending_free(ar);
idr_destroy(&ar->txmgmt_idr);
wake_up(&ar->txmgmt_empty_waitq);

12
drivers/net/wireless/ath/ath12k/mac.c
View File

@ -9194,13 +9194,13 @@ static void ath12k_mac_tx_mgmt_free(struct ath12k *ar, int buf_id)
ath12k_mgmt_over_wmi_tx_drop(ar, msdu);
}
int ath12k_mac_tx_mgmt_pending_free(int buf_id, void *skb, void *ctx)
void ath12k_mac_tx_mgmt_pending_free(struct ath12k *ar)
{
struct ath12k *ar = ctx;
struct sk_buff *msdu;
int buf_id;
ath12k_mac_tx_mgmt_free(ar, buf_id);
return 0;
idr_for_each_entry(&ar->txmgmt_idr, msdu, buf_id)
ath12k_mac_tx_mgmt_free(ar, buf_id);
}
static int ath12k_mac_vif_txmgmt_idr_remove(int buf_id, void *skb, void *ctx)
@ -14738,7 +14738,7 @@ static struct wiphy_iftype_ext_capab ath12k_iftypes_ext_capa[] = {
static void ath12k_mac_cleanup_unregister(struct ath12k *ar)
{
idr_for_each(&ar->txmgmt_idr, ath12k_mac_tx_mgmt_pending_free, ar);
ath12k_mac_tx_mgmt_pending_free(ar);
idr_destroy(&ar->txmgmt_idr);
kfree(ar->mac.sbands[NL80211_BAND_2GHZ].channels);

2
drivers/net/wireless/ath/ath12k/mac.h
View File

@ -173,7 +173,7 @@ struct ath12k *ath12k_mac_get_ar_by_pdev_id(struct ath12k_base *ab, u32 pdev_id)
void ath12k_mac_drain_tx(struct ath12k *ar);
void ath12k_mac_peer_cleanup_all(struct ath12k *ar);
void ath12k_mac_dp_peer_cleanup(struct ath12k_hw *ah);
int ath12k_mac_tx_mgmt_pending_free(int buf_id, void *skb, void *ctx);
void ath12k_mac_tx_mgmt_pending_free(struct ath12k *ar);
enum rate_info_bw ath12k_mac_bw_to_mac80211_bw(enum ath12k_supported_bw bw);
enum ath12k_supported_bw ath12k_mac_mac80211_bw_to_ath12k_bw(enum rate_info_bw bw);
enum hal_encrypt_type ath12k_dp_tx_get_encrypt_type(u32 cipher);