Re: [PATCH ath-next v2 12/17] wifi: ath12k: Enable MSI interrupt support for DP interrupt

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] wifi: ath12k: TOCTOU race drops edge-triggered MSI DP interrupts causing permanent stall
--

commit d922087bb1f873dbadddf00fcba276c1d612d2d7
Author: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>

wifi: ath12k: Enable MSI interrupt support for DP interrupt

This commit configures and requests external MSI interrupts for DP ring groups.
It creates a NAPI context for each active external interrupt group and disables
the corresponding IRQs while NAPI polling is in progress.

> diff --git a/drivers/net/wireless/ath/ath12k/pci.c b/drivers/net/wireless/ath/ath12k/pci.c
> index a26fdb3c0ad27..4bb14a95aec98 100644
> --- a/drivers/net/wireless/ath/ath12k/pci.c
> +++ b/drivers/net/wireless/ath/ath12k/pci.c
[ ... ]
> @@ -1118,7 +1122,7 @@ void ath12k_pci_ext_irq_enable(struct ath12k_base *ab)
>  	for (i = 0; i < ATH12K_EXT_IRQ_GRP_NUM_MAX; i++) {
>  		struct ath12k_ext_irq_grp *irq_grp = &ab->ext_irq_grp[i];
>  
> -		if (!irq_grp->napi_enabled) {
> +		if (irq_grp->napi_ndev && !irq_grp->napi_enabled) {
>  			napi_enable(&irq_grp->napi);
>  			irq_grp->napi_enabled = true;
>  		}

[Severity: High]
Can unmasking the hardware IRQs race with setting the software flag?

In ath12k_pci_ext_irq_enable(), ath12k_pci_ext_grp_enable() is called just
after this block to unmask the hardware IRQs, but the software flag
ATH12K_FLAG_EXT_IRQ_ENABLED is only set after the loop completes:

	ath12k_pci_ext_grp_enable(irq_grp);
}
set_bit(ATH12K_FLAG_EXT_IRQ_ENABLED, &ab->dev_flags);

If an MSI interrupt fires immediately after unmasking,
ath12k_pci_ext_interrupt_handler() drops it because the flag is still clear:

	if (!test_bit(ATH12K_FLAG_EXT_IRQ_ENABLED, &ab->dev_flags))
		return IRQ_HANDLED;

Since MSI interrupts are edge-triggered, dropping the interrupt without
scheduling NAPI leaves the hardware condition unacknowledged. No further MSI
will be generated, which could permanently stall the DP ring.

Since NAPI is already enabled for the group before unmasking the hardware IRQ,
is it safe to drop this interrupt, or could the flag be set earlier?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261016-mpp-bringup-v2-0-f510c33bfcf5@oss.qualcomm.com?part=12