Re: [PATCH ath-next v2 12/17] wifi: ath12k: Enable MSI interrupt support for DP interrupt

[Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>]

On 10/16/2026 9:11 AM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] wifi: ath12k: TOCTOU race drops edge-triggered MSI DP interrupts causing permanent stall
> --
> 
> commit d922087bb1f873dbadddf00fcba276c1d612d2d7
> Author: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
> 
> wifi: ath12k: Enable MSI interrupt support for DP interrupt
> 
> This commit configures and requests external MSI interrupts for DP ring groups.
> It creates a NAPI context for each active external interrupt group and disables
> the corresponding IRQs while NAPI polling is in progress.
> 
>> diff --git a/drivers/net/wireless/ath/ath12k/pci.c b/drivers/net/wireless/ath/ath12k/pci.c
>> index a26fdb3c0ad27..4bb14a95aec98 100644
>> --- a/drivers/net/wireless/ath/ath12k/pci.c
>> +++ b/drivers/net/wireless/ath/ath12k/pci.c
> [ ... ]
>> @@ -1118,7 +1122,7 @@ void ath12k_pci_ext_irq_enable(struct ath12k_base *ab)
>>  	for (i = 0; i < ATH12K_EXT_IRQ_GRP_NUM_MAX; i++) {
>>  		struct ath12k_ext_irq_grp *irq_grp = &ab->ext_irq_grp[i];
>>  
>> -		if (!irq_grp->napi_enabled) {
>> +		if (irq_grp->napi_ndev && !irq_grp->napi_enabled) {
>>  			napi_enable(&irq_grp->napi);
>>  			irq_grp->napi_enabled = true;
>>  		}
> 
> [Severity: High]
> Can unmasking the hardware IRQs race with setting the software flag?
> 
> In ath12k_pci_ext_irq_enable(), ath12k_pci_ext_grp_enable() is called just
> after this block to unmask the hardware IRQs, but the software flag
> ATH12K_FLAG_EXT_IRQ_ENABLED is only set after the loop completes:
> 
> 	ath12k_pci_ext_grp_enable(irq_grp);
> }
> set_bit(ATH12K_FLAG_EXT_IRQ_ENABLED, &ab->dev_flags);
> 
> If an MSI interrupt fires immediately after unmasking,
> ath12k_pci_ext_interrupt_handler() drops it because the flag is still clear:
> 
> 	if (!test_bit(ATH12K_FLAG_EXT_IRQ_ENABLED, &ab->dev_flags))
> 		return IRQ_HANDLED;
> 
> Since MSI interrupts are edge-triggered, dropping the interrupt without
> scheduling NAPI leaves the hardware condition unacknowledged. No further MSI
> will be generated, which could permanently stall the DP ring.
> 
> Since NAPI is already enabled for the group before unmasking the hardware IRQ,
> is it safe to drop this interrupt, or could the flag be set earlier?
> 

The expectation is that ATH12K_FLAG_EXT_IRQ_ENABLED is set after the IRQ
configuration and enable sequence is completed. NAPI is already enabled before
the hardware IRQs are unmasked.