RE: [BUG] rtw89: kernel panic in rtw89_core_acquire_sta_ba_entry (list_del corruption)

[Ping-Ke Shih <pkshih@realtek.com>]

[-- Attachment #1: Type: text/plain, Size: 2138 bytes --]

(please use plain text and not top posting)

secure_email <securelevelone@gmail.com>  wrote:
> Hardware: Realtek RTL8922AE (rtw89_8922ae)
> Kernel version: 7.1.6-201.fc44.x86_64
> Distribution: Fedora Cosmic Atomic 44
> 
> Description:
> A kernel panic occurs during Block Ack (BA) session acquisition/
> teardown in the rtw89 driver.
> The kernel reports a "list_del corruption" inside 
> rtw89_core_acquire_sta_ba_entry, which points to a potential race 
> condition or missing lock during BA entry management under Wi-Fi load.

Both rtw89_core_acquire_sta_ba_entry() and rtw89_core_release_sta_ba_entry()
hold wiphy_lock(), so I think there should be no race condition.

> 
> Steps to reproduce:
> 1. Use computer regularly (specifically on wifi as that is how bug is 
> triggered) no matter if downloading some files, surfing the web, 
> gaming or stepping away from PC.
> 2. Within a few minutes and up to around 40 minutes bug is triggered.

From this point, it did connection and disconnection frequently. Are they
intentional or something wrong?

May 19 23:47:52 kernel: wlp8s0: authenticate with xx:xx:xx:xx:xx:xx

The connection becomes disconnected about 1~5 minutes. Did you control
WiFi via GUI?

May 19 23:53:06 kernel: wlp8s0: associated
May 19 23:54:06 kernel: wlp8s0: deauthenticating from xx:xx:xx:xx:xx:xx

Try to disable power save to see if it can become better:

   sudo iw wlan0 set power_save off

> 
> System behavior:
> Wifi toggle in settings stops functioning (stuck on "enabled"), 
> followed by degradation in certain applications, loss of internet 
> connectivity both in terminal and browser, etc., and if I decide to 
> reboot the system it will hang indefinitely unless I do a hard 
> shutdown.
> 
> Call Trace / Panic Logs can be found in the attachments below.
> 
> Additional info:
> I initially reported this on Red Hat Bugzilla (Bug 2497973), but am 
> sending this upstream as requested to help get the panic backtrace in 
> front of rtw89 maintainers.
> 
>

Please apply attached debug patch, and collect and share log to me. 

Ping-Ke


[-- Attachment #2: 20260908_00_print_ba_cam.patch --]
[-- Type: application/octet-stream, Size: 2671 bytes --]

commit 4773ff0a77bbc48364e774809ce5abb27068ce7e
Author: Ping-Ke Shih <pkshih@realtek.com>
Date:   Tue Sep 8 15:57:49 2026 +0800

    print ba cam
    
    Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>

diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
index 572d9c65a2dd..7e04da1fdf90 100644
--- a/drivers/net/wireless/realtek/rtw89/core.c
+++ b/drivers/net/wireless/realtek/rtw89/core.c
@@ -5624,7 +5624,14 @@ int rtw89_core_acquire_sta_ba_entry(struct rtw89_dev *rtwdev,
 
 	lockdep_assert_wiphy(rtwdev->hw->wiphy);
 
+	printk("%s:%d\n", __func__, __LINE__);
+
 	idx = rtw89_core_acquire_bit_map(cam_info->ba_cam_map, chip->bacam_num);
+
+	printk("\t%s:%d acquire entry=%d all=%*ph rtwsta_link=%p tid=%d\n", __func__, __LINE__,
+		idx, (int)sizeof(cam_info->ba_cam_map), cam_info->ba_cam_map,
+		rtwsta_link, tid);
+
 	if (idx == chip->bacam_num) {
 		/* allocate a static BA CAM to tid=0/5, so replace the existing
 		 * one if BA CAM is full. Hardware will process the original tid
@@ -5640,7 +5647,12 @@ int rtw89_core_acquire_sta_ba_entry(struct rtw89_dev *rtwdev,
 
 			idx = i;
 			entry = tmp;
-			list_del(&entry->list);
+
+	printk("\t%s:%d replace entry=%d all=%*ph rtwsta_link=%p tid=%d\n", __func__, __LINE__,
+		idx, (int)sizeof(cam_info->ba_cam_map), cam_info->ba_cam_map,
+		rtwsta_link, tid);
+
+			list_del_init(&entry->list);
 			break;
 		}
 
@@ -5650,6 +5662,10 @@ int rtw89_core_acquire_sta_ba_entry(struct rtw89_dev *rtwdev,
 		entry = &cam_info->ba_cam_entry[idx];
 	}
 
+	printk("\t%s:%d add     entry=%d all=%*ph rtwsta_link=%p tid=%d\n", __func__, __LINE__,
+		idx, (int)sizeof(cam_info->ba_cam_map), cam_info->ba_cam_map,
+		rtwsta_link, tid);
+
 	entry->tid = tid;
 	list_add_tail(&entry->list, &rtwsta_link->ba_cam_list);
 
@@ -5668,14 +5684,25 @@ int rtw89_core_release_sta_ba_entry(struct rtw89_dev *rtwdev,
 
 	lockdep_assert_wiphy(rtwdev->hw->wiphy);
 
+	printk("%s:%d\n", __func__, __LINE__);
+
 	list_for_each_entry_safe(entry, tmp, &rtwsta_link->ba_cam_list, list) {
 		if (entry->tid != tid)
 			continue;
 
+	printk("\t%s:%d release entry=%d all=%*ph rtwsta_link=%p tid=%d (before)\n", __func__, __LINE__,
+		idx, (int)sizeof(cam_info->ba_cam_map), cam_info->ba_cam_map,
+		rtwsta_link, tid);
+
 		idx = entry - cam_info->ba_cam_entry;
-		list_del(&entry->list);
+		list_del_init(&entry->list);
 
 		rtw89_core_release_bit_map(cam_info->ba_cam_map, idx);
+
+	printk("\t%s:%d release entry=%d all=%*ph rtwsta_link=%p tid=%d (after)\n", __func__, __LINE__,
+		idx, (int)sizeof(cam_info->ba_cam_map), cam_info->ba_cam_map,
+		rtwsta_link, tid);
+
 		*cam_idx = idx;
 		return 0;
 	}