From: Jiale Yao <yaojiale02@163.com>
To: Jeff Johnson <jjohnson@kernel.org>,
Manikanta Pubbisetty <quic_mpubbise@quicinc.com>,
kbuild test robot <lkp@intel.com>,
Vasanthakumar Thiagarajan <quic_vthiagar@quicinc.com>,
Maharaja Kennadyrajan <quic_mkenna@quicinc.com>,
Rajkumar Manoharan <rmanohar@codeaurora.org>,
linux-wireless@vger.kernel.org, ath11k@lists.infradead.org,
linux-kernel@vger.kernel.org
Cc: Jiale Yao <yaojiale02@163.com>
Subject: [PATCH v2 2/5] wifi: ath11k: avoid IDR mutation during pending mgmt TX cleanup
Date: Sat, 3 Oct 2026 17:20:59 +0800 [thread overview]
Message-ID: <20261003092104.520135-3-yaojiale02@163.com> (raw)
In-Reply-To: <20261003092104.520135-1-yaojiale02@163.com>
The pending management TX cleanup walks txmgmt_idr with idr_for_each(),
and its callback removes the current entry. This can invalidate the
radix-tree iterator retained by idr_for_each().
Use idr_for_each_entry() so every iteration starts with a fresh lookup.
Continue to remove each entry under txmgmt_idr_lock before freeing its skb,
preventing concurrent TX completion from finding a stale skb pointer.
Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/net/wireless/ath/ath11k/core.c | 3 +--
drivers/net/wireless/ath/ath11k/mac.c | 12 ++++++------
drivers/net/wireless/ath/ath11k/mac.h | 2 +-
3 files changed, 8 insertions(+), 9 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c
index 8039124e7832..31ac17c51036 100644
--- a/drivers/net/wireless/ath/ath11k/core.c
+++ b/drivers/net/wireless/ath/ath11k/core.c
@@ -2449,8 +2449,7 @@ void ath11k_core_pre_reconfigure_recovery(struct ath11k_base *ab)
complete(&ar->thermal.wmi_sync);
wake_up(&ar->dp.tx_empty_waitq);
- idr_for_each(&ar->txmgmt_idr,
- ath11k_mac_tx_mgmt_pending_free, ar);
+ ath11k_mac_tx_mgmt_pending_free(ar);
idr_destroy(&ar->txmgmt_idr);
wake_up(&ar->txmgmt_empty_waitq);
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index ae91b57c8422..f9af403a2f0d 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -6167,13 +6167,13 @@ static void ath11k_mac_tx_mgmt_free(struct ath11k *ar, int buf_id)
ath11k_mgmt_over_wmi_tx_drop(ar, msdu);
}
-int ath11k_mac_tx_mgmt_pending_free(int buf_id, void *skb, void *ctx)
+void ath11k_mac_tx_mgmt_pending_free(struct ath11k *ar)
{
- struct ath11k *ar = ctx;
-
- ath11k_mac_tx_mgmt_free(ar, buf_id);
+ struct sk_buff *msdu;
+ int buf_id;
- return 0;
+ idr_for_each_entry(&ar->txmgmt_idr, msdu, buf_id)
+ ath11k_mac_tx_mgmt_free(ar, buf_id);
}
static int ath11k_mac_vif_txmgmt_idr_remove(int buf_id, void *skb, void *ctx)
@@ -10417,7 +10417,7 @@ static void __ath11k_mac_unregister(struct ath11k *ar)
ieee80211_unregister_hw(ar->hw);
- idr_for_each(&ar->txmgmt_idr, ath11k_mac_tx_mgmt_pending_free, ar);
+ ath11k_mac_tx_mgmt_pending_free(ar);
idr_destroy(&ar->txmgmt_idr);
kfree(ar->mac.sbands[NL80211_BAND_2GHZ].channels);
diff --git a/drivers/net/wireless/ath/ath11k/mac.h b/drivers/net/wireless/ath/ath11k/mac.h
index 59f83c7175fd..127cb476b44b 100644
--- a/drivers/net/wireless/ath/ath11k/mac.h
+++ b/drivers/net/wireless/ath/ath11k/mac.h
@@ -162,7 +162,7 @@ struct ath11k *ath11k_mac_get_ar_by_pdev_id(struct ath11k_base *ab, u32 pdev_id)
void ath11k_mac_drain_tx(struct ath11k *ar);
void ath11k_mac_peer_cleanup_all(struct ath11k *ar);
-int ath11k_mac_tx_mgmt_pending_free(int buf_id, void *skb, void *ctx);
+void ath11k_mac_tx_mgmt_pending_free(struct ath11k *ar);
u8 ath11k_mac_bw_to_mac80211_bw(u8 bw);
enum nl80211_he_gi ath11k_mac_he_gi_to_nl80211_he_gi(u8 sgi);
enum nl80211_he_ru_alloc ath11k_mac_phy_he_ru_to_nl80211_he_ru_alloc(u16 ru_phy);
--
2.34.1
next prev parent reply other threads:[~2026-10-03 9:21 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-03 9:20 [PATCH v2 0/5] wifi: ath: avoid IDR mutation while iterating Jiale Yao
2026-10-03 9:20 ` [PATCH v2 1/5] wifi: ath10k: avoid IDR mutation during TX cleanup Jiale Yao
2026-10-03 9:20 ` Jiale Yao [this message]
2026-10-03 9:21 ` [PATCH v2 3/5] wifi: ath11k: avoid IDR mutation during vif mgmt " Jiale Yao
2026-10-03 9:21 ` [PATCH v2 4/5] wifi: ath12k: avoid IDR mutation during pending " Jiale Yao
2026-10-03 9:21 ` [PATCH v2 5/5] wifi: ath12k: avoid IDR mutation during vif " Jiale Yao
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261003092104.520135-3-yaojiale02@163.com \
--to=yaojiale02@163.com \
--cc=ath11k@lists.infradead.org \
--cc=jjohnson@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=lkp@intel.com \
--cc=quic_mkenna@quicinc.com \
--cc=quic_mpubbise@quicinc.com \
--cc=quic_vthiagar@quicinc.com \
--cc=rmanohar@codeaurora.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox