From: Ping-Ke Shih <pkshih@realtek.com>
To: <linux-wireless@vger.kernel.org>
Cc: <dian_syuan0116@realtek.com>, <echuang@realtek.com>,
<phhuang@realtek.com>, <kevin_yang@realtek.com>
Subject: [PATCH rtw-next 08/15] wifi: rtw89: explicitly declare TX queue flags by DECLARE_BITMAP()
Date: Wed, 9 Sep 2026 14:59:57 +0800 [thread overview]
Message-ID: <20260909070004.35353-9-pkshih@realtek.com> (raw)
In-Reply-To: <20260909070004.35353-1-pkshih@realtek.com>
From: Zong-Zhe Yang <kevin_yang@realtek.com>
Originally, TX queue flags was declared by pure unsigned long but was
used with bitops, e.g. test_bit. Although for now, there are not much
cases in enum rtw89_txq_flags to be over than bits that one long can
deal with, it indeed missed logical boundary check. Refine it to be
declared by DECLARE_BITMAP().
Resolve ARRAY_VS_SINGLETON (Out-of-bounds access) reported by Coverity.
(doesn't change logic)
Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
drivers/net/wireless/realtek/rtw89/core.c | 24 +++++++++----------
drivers/net/wireless/realtek/rtw89/core.h | 5 +++-
drivers/net/wireless/realtek/rtw89/mac80211.c | 4 ++--
3 files changed, 18 insertions(+), 15 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
index 8ab15ee1b155..b074b3677c43 100644
--- a/drivers/net/wireless/realtek/rtw89/core.c
+++ b/drivers/net/wireless/realtek/rtw89/core.c
@@ -4625,7 +4625,7 @@ static void rtw89_core_ba_work(struct work_struct *work)
"failed to setup BA session for %pM:%2d: %d\n",
sta->addr, tid, ret);
if (ret == -EINVAL)
- set_bit(RTW89_TXQ_F_BLOCK_BA, &rtwtxq->flags);
+ set_bit(RTW89_TXQ_F_BLOCK_BA, rtwtxq->flags);
}
skip_ba_work:
list_del_init(&rtwtxq->list);
@@ -4658,7 +4658,7 @@ void rtw89_core_free_sta_pending_forbid_ba(struct rtw89_dev *rtwdev,
struct ieee80211_txq *txq = rtw89_txq_to_txq(rtwtxq);
if (sta == txq->sta) {
- clear_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags);
+ clear_bit(RTW89_TXQ_F_FORBID_BA, rtwtxq->flags);
list_del_init(&rtwtxq->list);
}
}
@@ -4685,12 +4685,12 @@ static void rtw89_core_stop_tx_ba_session(struct rtw89_dev *rtwdev,
if (unlikely(!rtwsta) || unlikely(rtwsta->disassoc))
return;
- if (!test_bit(RTW89_TXQ_F_AMPDU, &rtwtxq->flags) ||
- test_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags))
+ if (!test_bit(RTW89_TXQ_F_AMPDU, rtwtxq->flags) ||
+ test_bit(RTW89_TXQ_F_FORBID_BA, rtwtxq->flags))
return;
spin_lock_bh(&rtwdev->ba_lock);
- if (!test_and_set_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags))
+ if (!test_and_set_bit(RTW89_TXQ_F_FORBID_BA, rtwtxq->flags))
list_add_tail(&rtwtxq->list, &rtwdev->forbid_ba_list);
spin_unlock_bh(&rtwdev->ba_lock);
@@ -4709,7 +4709,7 @@ static void rtw89_core_txq_check_agg(struct rtw89_dev *rtwdev,
struct ieee80211_sta *sta = txq->sta;
struct rtw89_sta *rtwsta = sta_to_rtwsta_safe(sta);
- if (test_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags))
+ if (test_bit(RTW89_TXQ_F_FORBID_BA, rtwtxq->flags))
return;
if (unlikely(skb->protocol == cpu_to_be16(ETH_P_PAE))) {
@@ -4720,10 +4720,10 @@ static void rtw89_core_txq_check_agg(struct rtw89_dev *rtwdev,
if (unlikely(!sta))
return;
- if (unlikely(test_bit(RTW89_TXQ_F_BLOCK_BA, &rtwtxq->flags)))
+ if (unlikely(test_bit(RTW89_TXQ_F_BLOCK_BA, rtwtxq->flags)))
return;
- if (test_bit(RTW89_TXQ_F_AMPDU, &rtwtxq->flags)) {
+ if (test_bit(RTW89_TXQ_F_AMPDU, rtwtxq->flags)) {
IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_AMPDU;
return;
}
@@ -4901,7 +4901,7 @@ static void rtw89_forbid_ba_work(struct work_struct *w)
spin_lock_bh(&rtwdev->ba_lock);
list_for_each_entry_safe(rtwtxq, tmp, &rtwdev->forbid_ba_list, list) {
- clear_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags);
+ clear_bit(RTW89_TXQ_F_FORBID_BA, rtwtxq->flags);
list_del_init(&rtwtxq->list);
}
spin_unlock_bh(&rtwdev->ba_lock);
@@ -6036,13 +6036,13 @@ static void _rtw89_core_set_tid_config(struct rtw89_dev *rtwdev,
if (mask & BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL)) {
if (tid_conf->ampdu == NL80211_TID_CONFIG_ENABLE) {
- clear_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags);
+ clear_bit(RTW89_TXQ_F_FORBID_BA, rtwtxq->flags);
} else {
- if (test_bit(RTW89_TXQ_F_AMPDU, &rtwtxq->flags))
+ if (test_bit(RTW89_TXQ_F_AMPDU, rtwtxq->flags))
ieee80211_stop_tx_ba_session(sta, txq->tid);
spin_lock_bh(&rtwdev->ba_lock);
list_del_init(&rtwtxq->list);
- set_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags);
+ set_bit(RTW89_TXQ_F_FORBID_BA, rtwtxq->flags);
spin_unlock_bh(&rtwdev->ba_lock);
}
}
diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h
index c300d15581fc..d725124b39bf 100644
--- a/drivers/net/wireless/realtek/rtw89/core.h
+++ b/drivers/net/wireless/realtek/rtw89/core.h
@@ -244,6 +244,8 @@ enum rtw89_txq_flags {
RTW89_TXQ_F_AMPDU = 0,
RTW89_TXQ_F_BLOCK_BA = 1,
RTW89_TXQ_F_FORBID_BA = 2,
+
+ NUM_OF_RTW89_TXQ_FLAGS,
};
enum rtw89_net_type {
@@ -1313,8 +1315,9 @@ struct rtw89_core_tx_request {
struct rtw89_txq {
struct list_head list;
- unsigned long flags;
int wait_cnt;
+
+ DECLARE_BITMAP(flags, NUM_OF_RTW89_TXQ_FLAGS);
};
struct rtw89_mac_ax_gnt {
diff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c
index c1be69a3c192..cf356a54d91c 100644
--- a/drivers/net/wireless/realtek/rtw89/mac80211.c
+++ b/drivers/net/wireless/realtek/rtw89/mac80211.c
@@ -1043,7 +1043,7 @@ static int rtw89_ops_ampdu_action(struct ieee80211_hw *hw,
case IEEE80211_AMPDU_TX_STOP_CONT:
case IEEE80211_AMPDU_TX_STOP_FLUSH:
case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
- clear_bit(RTW89_TXQ_F_AMPDU, &rtwtxq->flags);
+ clear_bit(RTW89_TXQ_F_AMPDU, rtwtxq->flags);
clear_bit(tid, rtwsta->ampdu_map);
rtw89_chip_h2c_ampdu_cmac_tbl(rtwdev, rtwvif, rtwsta);
ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
@@ -1051,7 +1051,7 @@ static int rtw89_ops_ampdu_action(struct ieee80211_hw *hw,
rtw89_phy_ra_recalc_agg_limit(rtwdev);
break;
case IEEE80211_AMPDU_TX_OPERATIONAL:
- set_bit(RTW89_TXQ_F_AMPDU, &rtwtxq->flags);
+ set_bit(RTW89_TXQ_F_AMPDU, rtwtxq->flags);
rtwsta->ampdu_params[tid].agg_num = params->buf_size;
rtwsta->ampdu_params[tid].amsdu = params->amsdu;
set_bit(tid, rtwsta->ampdu_map);
--
2.25.1
next prev parent reply other threads:[~2026-09-09 7:01 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-09 6:59 [PATCH rtw-next 00/15] wifi: rtw89: correct MLO behavior, fix Coverity issues, and update hardware settings Ping-Ke Shih
2026-09-09 6:59 ` [PATCH rtw-next 01/15] wifi: rtw89: consider sta maximum AMSDU subframes number to decide TX work waiting Ping-Ke Shih
2026-09-09 6:59 ` [PATCH rtw-next 02/15] wifi: rtw89: mlo: update link id to FW upon connection Ping-Ke Shih
2026-09-09 6:59 ` [PATCH rtw-next 03/15] Revert "wifi: rtw89: fix unable to receive probe responses under MLO connection" Ping-Ke Shih
2026-09-09 6:59 ` [PATCH rtw-next 04/15] wifi: rtw89: modify active scan rule for 6GHz band Ping-Ke Shih
2026-09-09 6:59 ` [PATCH rtw-next 05/15] wifi: rtw89: fix ctrl_sco_cck for Wi-Fi 7 Ping-Ke Shih
2026-09-09 6:59 ` [PATCH rtw-next 06/15] wifi: rtw89: 8852a: prevent potential OOB in ctrl_sco_cck Ping-Ke Shih
2026-09-09 6:59 ` [PATCH rtw-next 07/15] wifi: rtw89: fw: cmd_ofld_flush always reset counter Ping-Ke Shih
2026-09-09 6:59 ` Ping-Ke Shih [this message]
2026-09-09 6:59 ` [PATCH rtw-next 09/15] wifi: rtw89: 8922d: add extra data to PS H2C Ping-Ke Shih
2026-09-09 6:59 ` [PATCH rtw-next 10/15] wifi: rtw89: mac: change beamformee CSI direct forward to CMAC_TXDMA Ping-Ke Shih
2026-09-09 7:00 ` [PATCH rtw-next 11/15] wifi: rtw89: fw: extend ch_info format of hw_scan to v2 Ping-Ke Shih
2026-09-09 7:00 ` [PATCH rtw-next 12/15] wifi: rtw89: 8922d: update BA cam format to G7 Ping-Ke Shih
2026-09-09 7:00 ` [PATCH rtw-next 13/15] wifi: rtw89: 8851b: rfk: set DCK start and delay time Ping-Ke Shih
2026-09-09 7:00 ` [PATCH rtw-next 14/15] wifi: rtw89: 8852b: update default value for ANA SWR Ping-Ke Shih
2026-09-09 7:00 ` [PATCH rtw-next 15/15] wifi: rtw89: phy: correct PHY-1 EDCCA report register access Ping-Ke Shih
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260909070004.35353-9-pkshih@realtek.com \
--to=pkshih@realtek.com \
--cc=dian_syuan0116@realtek.com \
--cc=echuang@realtek.com \
--cc=kevin_yang@realtek.com \
--cc=linux-wireless@vger.kernel.org \
--cc=phhuang@realtek.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox