From: Ping-Ke Shih <pkshih@realtek.com>
To: <linux-wireless@vger.kernel.org>
Cc: <dian_syuan0116@realtek.com>, <echuang@realtek.com>,
<phhuang@realtek.com>, <kevin_yang@realtek.com>
Subject: [PATCH rtw-next 08/15] wifi: rtw89: explicitly declare TX queue flags by DECLARE_BITMAP()
Date: Wed, 9 Sep 2026 14:59:57 +0800 [thread overview]
Message-ID: <20260909070004.35353-9-pkshih@realtek.com> (raw)
In-Reply-To: <20260909070004.35353-1-pkshih@realtek.com>
From: Zong-Zhe Yang <kevin_yang@realtek.com>
Originally, TX queue flags was declared by pure unsigned long but was
used with bitops, e.g. test_bit. Although for now, there are not much
cases in enum rtw89_txq_flags to be over than bits that one long can
deal with, it indeed missed logical boundary check. Refine it to be
declared by DECLARE_BITMAP().
Resolve ARRAY_VS_SINGLETON (Out-of-bounds access) reported by Coverity.
(doesn't change logic)
Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
drivers/net/wireless/realtek/rtw89/core.c | 24 +++++++++----------
drivers/net/wireless/realtek/rtw89/core.h | 5 +++-
drivers/net/wireless/realtek/rtw89/mac80211.c | 4 ++--
3 files changed, 18 insertions(+), 15 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
index 8ab15ee1b155..b074b3677c43 100644
--- a/drivers/net/wireless/realtek/rtw89/core.c
+++ b/drivers/net/wireless/realtek/rtw89/core.c
@@ -4625,7 +4625,7 @@ static void rtw89_core_ba_work(struct work_struct *work)
"failed to setup BA session for %pM:%2d: %d\n",
sta->addr, tid, ret);
if (ret == -EINVAL)
- set_bit(RTW89_TXQ_F_BLOCK_BA, &rtwtxq->flags);
+ set_bit(RTW89_TXQ_F_BLOCK_BA, rtwtxq->flags);
}
skip_ba_work:
list_del_init(&rtwtxq->list);
@@ -4658,7 +4658,7 @@ void rtw89_core_free_sta_pending_forbid_ba(struct rtw89_dev *rtwdev,
struct ieee80211_txq *txq = rtw89_txq_to_txq(rtwtxq);
if (sta == txq->sta) {
- clear_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags);
+ clear_bit(RTW89_TXQ_F_FORBID_BA, rtwtxq->flags);
list_del_init(&rtwtxq->list);
}
}
@@ -4685,12 +4685,12 @@ static void rtw89_core_stop_tx_ba_session(struct rtw89_dev *rtwdev,
if (unlikely(!rtwsta) || unlikely(rtwsta->disassoc))
return;
- if (!test_bit(RTW89_TXQ_F_AMPDU, &rtwtxq->flags) ||
- test_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags))
+ if (!test_bit(RTW89_TXQ_F_AMPDU, rtwtxq->flags) ||
+ test_bit(RTW89_TXQ_F_FORBID_BA, rtwtxq->flags))
return;
spin_lock_bh(&rtwdev->ba_lock);
- if (!test_and_set_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags))
+ if (!test_and_set_bit(RTW89_TXQ_F_FORBID_BA, rtwtxq->flags))
list_add_tail(&rtwtxq->list, &rtwdev->forbid_ba_list);
spin_unlock_bh(&rtwdev->ba_lock);
@@ -4709,7 +4709,7 @@ static void rtw89_core_txq_check_agg(struct rtw89_dev *rtwdev,
struct ieee80211_sta *sta = txq->sta;
struct rtw89_sta *rtwsta = sta_to_rtwsta_safe(sta);
- if (test_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags))
+ if (test_bit(RTW89_TXQ_F_FORBID_BA, rtwtxq->flags))
return;
if (unlikely(skb->protocol == cpu_to_be16(ETH_P_PAE))) {
@@ -4720,10 +4720,10 @@ static void rtw89_core_txq_check_agg(struct rtw89_dev *rtwdev,
if (unlikely(!sta))
return;
- if (unlikely(test_bit(RTW89_TXQ_F_BLOCK_BA, &rtwtxq->flags)))
+ if (unlikely(test_bit(RTW89_TXQ_F_BLOCK_BA, rtwtxq->flags)))
return;
- if (test_bit(RTW89_TXQ_F_AMPDU, &rtwtxq->flags)) {
+ if (test_bit(RTW89_TXQ_F_AMPDU, rtwtxq->flags)) {
IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_AMPDU;
return;
}
@@ -4901,7 +4901,7 @@ static void rtw89_forbid_ba_work(struct work_struct *w)
spin_lock_bh(&rtwdev->ba_lock);
list_for_each_entry_safe(rtwtxq, tmp, &rtwdev->forbid_ba_list, list) {
- clear_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags);
+ clear_bit(RTW89_TXQ_F_FORBID_BA, rtwtxq->flags);
list_del_init(&rtwtxq->list);
}
spin_unlock_bh(&rtwdev->ba_lock);
@@ -6036,13 +6036,13 @@ static void _rtw89_core_set_tid_config(struct rtw89_dev *rtwdev,
if (mask & BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL)) {
if (tid_conf->ampdu == NL80211_TID_CONFIG_ENABLE) {
- clear_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags);
+ clear_bit(RTW89_TXQ_F_FORBID_BA, rtwtxq->flags);
} else {
- if (test_bit(RTW89_TXQ_F_AMPDU, &rtwtxq->flags))
+ if (test_bit(RTW89_TXQ_F_AMPDU, rtwtxq->flags))
ieee80211_stop_tx_ba_session(sta, txq->tid);
spin_lock_bh(&rtwdev->ba_lock);
list_del_init(&rtwtxq->list);
- set_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags);
+ set_bit(RTW89_TXQ_F_FORBID_BA, rtwtxq->flags);
spin_unlock_bh(&rtwdev->ba_lock);
}
}
diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h
index c300d15581fc..d725124b39bf 100644
--- a/drivers/net/wireless/realtek/rtw89/core.h
+++ b/drivers/net/wireless/realtek/rtw89/core.h
@@ -244,6 +244,8 @@ enum rtw89_txq_flags {
RTW89_TXQ_F_AMPDU = 0,
RTW89_TXQ_F_BLOCK_BA = 1,
RTW89_TXQ_F_FORBID_BA = 2,
+
+ NUM_OF_RTW89_TXQ_FLAGS,
};
enum rtw89_net_type {
@@ -1313,8 +1315,9 @@ struct rtw89_core_tx_request {
struct rtw89_txq {
struct list_head list;
- unsigned long flags;
int wait_cnt;
+
+ DECLARE_BITMAP(flags, NUM_OF_RTW89_TXQ_FLAGS);
};
struct rtw89_mac_ax_gnt {
diff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c
index c1be69a3c192..cf356a54d91c 100644
--- a/drivers/net/wireless/realtek/rtw89/mac80211.c
+++ b/drivers/net/wireless/realtek/rtw89/mac80211.c
@@ -1043,7 +1043,7 @@ static int rtw89_ops_ampdu_action(struct ieee80211_hw *hw,
case IEEE80211_AMPDU_TX_STOP_CONT:
case IEEE80211_AMPDU_TX_STOP_FLUSH:
case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
- clear_bit(RTW89_TXQ_F_AMPDU, &rtwtxq->flags);
+ clear_bit(RTW89_TXQ_F_AMPDU, rtwtxq->flags);
clear_bit(tid, rtwsta->ampdu_map);
rtw89_chip_h2c_ampdu_cmac_tbl(rtwdev, rtwvif, rtwsta);
ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
@@ -1051,7 +1051,7 @@ static int rtw89_ops_ampdu_action(struct ieee80211_hw *hw,
rtw89_phy_ra_recalc_agg_limit(rtwdev);
break;
case IEEE80211_AMPDU_TX_OPERATIONAL:
- set_bit(RTW89_TXQ_F_AMPDU, &rtwtxq->flags);
+ set_bit(RTW89_TXQ_F_AMPDU, rtwtxq->flags);
rtwsta->ampdu_params[tid].agg_num = params->buf_size;
rtwsta->ampdu_params[tid].amsdu = params->amsdu;
set_bit(tid, rtwsta->ampdu_map);
--
2.25.1
next prev parent reply other threads:[~2026-09-09 7:01 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-09 6:59 [PATCH rtw-next 00/15] wifi: rtw89: correct MLO behavior, fix Coverity issues, and update hardware settings Ping-Ke Shih
2026-09-09 6:59 ` [PATCH rtw-next 01/15] wifi: rtw89: consider sta maximum AMSDU subframes number to decide TX work waiting Ping-Ke Shih
2026-09-09 6:59 ` [PATCH rtw-next 02/15] wifi: rtw89: mlo: update link id to FW upon connection Ping-Ke Shih
2026-09-09 6:59 ` [PATCH rtw-next 03/15] Revert "wifi: rtw89: fix unable to receive probe responses under MLO connection" Ping-Ke Shih
2026-09-09 6:59 ` [PATCH rtw-next 04/15] wifi: rtw89: modify active scan rule for 6GHz band Ping-Ke Shih
2026-09-09 6:59 ` [PATCH rtw-next 05/15] wifi: rtw89: fix ctrl_sco_cck for Wi-Fi 7 Ping-Ke Shih
2026-09-09 6:59 ` [PATCH rtw-next 06/15] wifi: rtw89: 8852a: prevent potential OOB in ctrl_sco_cck Ping-Ke Shih
2026-09-09 6:59 ` [PATCH rtw-next 07/15] wifi: rtw89: fw: cmd_ofld_flush always reset counter Ping-Ke Shih
2026-09-09 6:59 ` Ping-Ke Shih [this message]
2026-09-09 6:59 ` [PATCH rtw-next 09/15] wifi: rtw89: 8922d: add extra data to PS H2C Ping-Ke Shih
2026-09-09 6:59 ` [PATCH rtw-next 10/15] wifi: rtw89: mac: change beamformee CSI direct forward to CMAC_TXDMA Ping-Ke Shih
2026-09-09 7:00 ` [PATCH rtw-next 11/15] wifi: rtw89: fw: extend ch_info format of hw_scan to v2 Ping-Ke Shih
2026-09-09 7:00 ` [PATCH rtw-next 12/15] wifi: rtw89: 8922d: update BA cam format to G7 Ping-Ke Shih
2026-09-09 7:00 ` [PATCH rtw-next 13/15] wifi: rtw89: 8851b: rfk: set DCK start and delay time Ping-Ke Shih
2026-09-09 7:00 ` [PATCH rtw-next 14/15] wifi: rtw89: 8852b: update default value for ANA SWR Ping-Ke Shih
2026-09-09 7:00 ` [PATCH rtw-next 15/15] wifi: rtw89: phy: correct PHY-1 EDCCA report register access Ping-Ke Shih
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260909070004.35353-9-pkshih@realtek.com \
--to=pkshih@realtek.com \
--cc=dian_syuan0116@realtek.com \
--cc=echuang@realtek.com \
--cc=kevin_yang@realtek.com \
--cc=linux-wireless@vger.kernel.org \
--cc=phhuang@realtek.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.