> On 10/8/2026 6:15 AM, Lorenzo Bianconi wrote:
> > ath12k_wifi7_dp_rx_process_err() resolves the per-pdev datapath with
> > ath12k_dp_to_pdev_dp(dp, pdev_idx), using the local 'dp', while
> > 'pdev_idx' is computed from the owning 'partner_dp'. As dp_pdevs[] is
> > indexed per ath12k_dp, this picks the wrong pdev when the REO exception
> > descriptor was sourced by a partner device in a multi-device group.
> > 
> > The error is currently masked by the drop condition that only processes
> > same-device fragments (partner_dp->device_id == dp->device_id), but it
> > is still incorrect and would misbehave as soon as that restriction is
> > relaxed.
> > 
> > Look the pdev datapath up from partner_dp, as already done in the other
> > Rx processing paths.
> > 
> > Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3
> 
> Tested-on is not an official upstream tag but is an ath-specific tag. There
> should be a blank line separating this tag from the official tags.
> 
> No need to repost for this, I can fix it in my tree.

ack, thx.

> 
> > Fixes: 9e0ee04f818f ("wifi: ath12k: Refactor data path pdev struct")
> 
> If this issue is masked then IMO we don't need to backport to LTS kernels and
> hence should drop the fixes tag or add Cc: <stable+noautosel@kernel.org>

ack.

Regards,
Lorenzo

> 
> > Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com>
> > ---
> >  drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c b/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c
> > index a32c804403e8..633cb91b9e5d 100644
> > --- a/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c
> > +++ b/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c
> > @@ -1536,7 +1536,7 @@ int ath12k_wifi7_dp_rx_process_err(struct ath12k_dp *dp, struct napi_struct *nap
> >  
> >  		rcu_read_lock();
> >  
> > -		dp_pdev = ath12k_dp_to_pdev_dp(dp, pdev_idx);
> > +		dp_pdev = ath12k_dp_to_pdev_dp(partner_dp, pdev_idx);
> >  		if (!dp_pdev) {
> >  			rcu_read_unlock();
> >  			continue;
> > 
>