From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7E9DF3016F7 for ; Fri, 15 May 2026 06:39:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778827175; cv=none; b=K4uwbsWv37BNw01zaZ/OpvICbsLhTbAdbxQ+G2pPhHXyeTS/iTu3I8f+hciBshUYbusuq8+2IBs5XKK6PEaEO/PKYxbNYKVqTmdsPO8n/OSmw3KRAMRu/QF+p9VfDpGIW+palHCH0jlp0BZgsdNUL3Jrv9MfOMJZjREcpUaVwvk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778827175; c=relaxed/simple; bh=UoKL1iVfccKojdCih8dTQdQ6c2I1ZzQDM2RG7usJpoQ=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=Qkk/h/evLRJ/GuCdCN2fxGNRmLezKilRL0ZAMfjLhjNf0HlVojHER+Qm/PPjEgVIeAwbrfcFrHBcJ23k8JTXSC+c52YSNhf36JBEa/hWZjGiR9TzQhGO/xtOLBeJn6VLD66Lr0khBdj4yUEFSLdounVDQc08HcjuSMT5OoT4mR0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=fY5KILLG; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=V2XkxaRQ; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="fY5KILLG"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="V2XkxaRQ" Received: from pps.filterd (m0279867.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 64F5H9jf3670425 for ; Fri, 15 May 2026 06:39:34 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= JOLE131bcicG5PKOMByp2XiRYzJK1mHFyKZYnU5OtAY=; b=fY5KILLGfYghV3uj 0i2tmUarTPnr3T73M2VXyN4diQy1+JbyorwKkbd/zeTM7ATeA0QOQqFfLxGHiLiu Dqp1dc97RSV4D+Y5OICmgGlUWWxPA4uCJaAcvuHN3myRv7emKQ8okJaXWDaV7aYx 0ARpUeNZetORBVN1UKFm1ZFkyAt1wH9YHF6uA0UEWICJ7Ra9ZoewOtUG+u4au+WJ KW4mYff3/zv2fjXM9XJhLp0qkRbnAd0E1cCRlGwyxUotDXzX/rOox+qmx65zbf0j W8gjw0WFWYlZPSUliHXd3SOwkLWRUauKv857/RGqNaaEUed/y5cSzgueVoUTnRau RXg5RQ== Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4e5m1s1ygb-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 15 May 2026 06:39:33 +0000 (GMT) Received: by mail-pl1-f200.google.com with SMTP id d9443c01a7336-2bd00a65673so5443135ad.1 for ; Thu, 14 May 2026 23:39:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1778827173; x=1779431973; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:content-language:from :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=JOLE131bcicG5PKOMByp2XiRYzJK1mHFyKZYnU5OtAY=; b=V2XkxaRQk1qa/ue4ogwOkNZUm4JK/h/0gmplwOG0sVFKNVdoUWy1q262z7EKwrtUft Cj3rQBfkWeXrK024/MFN3Txm17qNU3s3NOjOsx707BHNoQ4duPyYBTHkgg3ZhlgW+WlX yvsSP+DnSIsam2YxWmqIB7T8uE3iKOghRXTHiIo+pvXbWAte3BZVMX4rrF+U8pOYQgBX S5eFgbdYXnt5Rcz1BvFx1Rz0Jkiqw7D2C+URiN37Wn11SdNQn28/2S1JSPQ7xDQKGttb h1jfrZc70SWt3lky5+C1mCfvkO2UoVboodIq1L0FBTAVrkvHJQcvCOD29uGVwFVdFz8d mphQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778827173; x=1779431973; h=content-transfer-encoding:in-reply-to:content-language:from :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=JOLE131bcicG5PKOMByp2XiRYzJK1mHFyKZYnU5OtAY=; b=aK5hx3WFl+xfdsgmfkHo6/xR0o2afvHaACXbRM7pLal6W7IQo9BBN4LaR+aPGRtCDN DV38xZDs1RDc6yqEigQhfJV0+ai+jJTEjfVPRuAQevEuw2mVkfVM2SZ6uwu50GOgw6e3 Qq3Zyq0qmzEip7kwTL+sY0VhhlG4H6HGpHfxpX6ljj7TTwpF3swieHxcrGhW6X8cLNNZ pVE9iqFrlUdqltGZy7tRBVyrx+K4jubxhISeCiY8VoTxhXoOG6q+2bIUHpAr0rQ0Udv5 kaGc3TRkgoMdvESLnCkweGjdFzcqvAQzyAG+Em3Rpyzy7GvfevrXOVnHSNRRKKL30SAz RdrA== X-Forwarded-Encrypted: i=1; AFNElJ/NluZFZP4rXJjFrRi12NEVTUyrBp/Ljcz74WrfXV2ooRDf7DtpxxjrzW1N6xozte3K+4Dw2P3z38bS6J4=@vger.kernel.org X-Gm-Message-State: AOJu0Yyq6Lx2scPZzsLt5p5Z1pJoZNbZjOKuNq+sxuLKmsohbH1PFs1x 6RjcwAZ85cImzCnJALVRRbClI7lhVjlKLTAGqznJ+RohO24APm+8+d2uIl+1GjWKBUtR1eVRQY6 +4ruAmgu/w7taQpqDmmQ2KIR2WnOuwtSRelu7Vq8ki9BtdEueMHeR7tIFzAQeZJCUdMo= X-Gm-Gg: Acq92OFubl98V/SanT4IC0/aKELL1eUSaWgNfFEZ4JEky8lHkNj2W+BnKb/G0KRfRAQ pz+WRnUTFRxljkkpRBg2i7yyNbqvKdWE9H9dmhbSOsW92StAMd3o5xZWxw8vnFJRfWA+v+gtOKk Ha5tXn7ydHeg69eta2yDWjicOB2vJfFNJgOdD/CBiymJu4CSj6ofvrHjIjq+CsOGLmQf9ffaWRp FqKt/QHQP7FaebC7R100Ua8DdbS8xsOMLBQjMN9To2jR/VJfJMLANMKdcMUnaETXCfJwOUrnnF1 IKHDqa/WpEEfJeA0w6Awqgl5LFcrkajtrZji5b2QkfqbOa9sQdDo1wEDxVUJ4SRxflZnVqZskeq I/mSAz8A0dP5KUY/ttDeVw56hlapfxZDhNu7wBdhvzppvsoI0QngX0/EJz6rFWr5OI+/iGC2IPM Bb8+4mUmVAoU8ipuiV+g== X-Received: by 2002:a17:903:1aef:b0:2b4:64cf:e8f8 with SMTP id d9443c01a7336-2bd526ce672mr66930505ad.2.1778827173105; Thu, 14 May 2026 23:39:33 -0700 (PDT) X-Received: by 2002:a17:903:1aef:b0:2b4:64cf:e8f8 with SMTP id d9443c01a7336-2bd526ce672mr66930195ad.2.1778827172576; Thu, 14 May 2026 23:39:32 -0700 (PDT) Received: from [10.133.33.33] (tpe-colo-wan-fw-bordernet.qualcomm.com. [103.229.16.4]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2bd5bd60275sm44600585ad.7.2026.05.14.23.39.30 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 14 May 2026 23:39:32 -0700 (PDT) Message-ID: <5bb180ea-d970-4cf0-8d01-620cbdb7be9e@oss.qualcomm.com> Date: Fri, 15 May 2026 14:39:28 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] wifi: ath11k: fix warning when unbinding To: Rameshkumar Sundaram , Jose Ignacio Tornos Martinez Cc: ath11k@lists.infradead.org, jjohnson@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, stable@vger.kernel.org References: <20260507070808.367442-1-jtornosm@redhat.com> <20260514061841.9517-1-jtornosm@redhat.com> <95bff017-3554-425f-ad8e-767f9cbe1277@oss.qualcomm.com> From: Baochen Qiang Content-Language: en-US In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNTE1MDA2NCBTYWx0ZWRfX6jVPtffhtEaa 09BrMCFvjA7OnRSQ14eFIZjodYt5JtLV6P9gDQIsS/2I9vuYmwQj1++XtPnwUP+YuYLqKXvyvL2 Y88si7VYSsshaPGdjLBRDBG2V4vpQlQ01Ei50e1YQnjmnQBxWSl6TapL8BYxAk0fb0JZudfZpzp 4l3PTBUAgIlrE1QN8OUUfNjgFEbbzhX5XJzLZQwV5EboTExf/ginUPUDuwQ9B9kG+KbEcGDrSx9 gxP0fNH8iLD23uZQCxCJcFAo/+iXU9NCMFytGhqxZneuE6YXZTnq8T2antxw6UOjha63Vm1S92Y X+jWUitQxdYNGysxSktPdkxryctcJnTgPPhATvj3KXIwCwAc+UGLO7VwjkEpPhOcaRjdioO1ern al5Y3uVjhhBFA0nCsHs/klujcjyAJUsZUX+8TjvrP3TWhgS433gRafondP09fEI4+LcC55fGHAe b1SLsIFfgTqm5CeJ8Dg== X-Authority-Analysis: v=2.4 cv=Md5cfZ/f c=1 sm=1 tr=0 ts=6a06bfa5 cx=c_pps a=IZJwPbhc+fLeJZngyXXI0A==:117 a=nuhDOHQX5FNHPW3J6Bj6AA==:17 a=IkcTkHD0fZMA:10 a=NGcC8JguVDcA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=eoimf2acIAo5FJnRuUoq:22 a=XMJksOS74nNapH2Mx7QA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=uG9DUKGECoFWVXl0Dc02:22 X-Proofpoint-GUID: VNm77ksa49Ps1JjICe_h9IiB4RppAQuk X-Proofpoint-ORIG-GUID: VNm77ksa49Ps1JjICe_h9IiB4RppAQuk X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-05-15_01,2026-05-13_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 lowpriorityscore=0 bulkscore=0 priorityscore=1501 impostorscore=0 malwarescore=0 adultscore=0 phishscore=0 spamscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2605130000 definitions=main-2605150064 On 5/15/2026 10:27 AM, Rameshkumar Sundaram wrote: > On 5/14/2026 1:45 PM, Baochen Qiang wrote: >> >> >> On 5/14/2026 2:55 PM, Rameshkumar Sundaram wrote: >>> On 5/14/2026 11:48 AM, Jose Ignacio Tornos Martinez wrote: >>>> Hello Rameshkumar, >>>> >>>>> I agree that setting tx_status to NULL makes ath11k_dp_free() more >>>>> defensive, and it matches the ath12k fix. >>>> Ok, I agree too. >>>> >>>>> However, i am still wondering how the second ath11k_dp_free() is reached >>>>> if ATH11K_FLAG_QMI_FAIL is set. >>>>> >>>>> In ath11k_pci_remove(), when ATH11K_FLAG_QMI_FAIL is set, we take the >>>>> qmi_fail path and skip ath11k_core_deinit(). So the normal remove path: >>>>> >>>>>       ath11k_pci_remove() >>>>>         ath11k_core_deinit() >>>>>           ath11k_core_soc_destroy() >>>>>             ath11k_dp_free() >>>>> >>>>> should not run. >>>>> >>>>> So if the double free is still reproducible with QMI_FAIL set (with the >>>>> change i proposed), either the flag is not actually set in this failure >>>>> case, or there is another path calling ath11k_dp_free() ? >>>> Let me try to clarify the issue more. >>>> There are two error actions: >>>> - First the previous error. I reproduce the situation as I commented: running >>>> in a VM the default upstream kernel (with this card using PCI passthrough), >>>> since this is always failing. Let me show the logs in this situation: >>>> [   15.906564] ath11k_pci 0000:07:00.0: BAR 0 [mem 0xfdc00000-0xfddfffff 64bit]: assigned >>>> [   15.926520] ath11k_pci 0000:07:00.0: MSI vectors: 32 >>>> [   15.928572] ath11k_pci 0000:07:00.0: wcn6855 hw2.0 >>>> [   16.984192] ath11k_pci 0000:07:00.0: chip_id 0x2 chip_family 0xb board_id 0xff soc_id >>>> 0x400c0200 >>>> [   16.984351] ath11k_pci 0000:07:00.0: fw_version 0x11088c35 fw_build_timestamp >>>> 2024-04-17 08:34 fw_build_id WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41 >>>> [   18.186971] ath11k_pci 0000:07:00.0: failed to receive control response completion, >>>> polling.. >>>> [   19.211036] ath11k_pci 0000:07:00.0: Service connect timeout >>>> [   19.211815] ath11k_pci 0000:07:00.0: failed to connect to HTT: -110 >>>> [   19.214181] ath11k_pci 0000:07:00.0: failed to start core: -110 >>>> [   19.531989] ath11k_pci 0000:07:00.0: firmware crashed: MHI_CB_EE_RDDM >>>> [   19.532930] ath11k_pci 0000:07:00.0: ignore reset dev flags 0xc000 >>>> [   29.259157] ath11k_pci 0000:07:00.0: failed to wait wlan mode request (mode 4): -110 >>>> [   29.259229] ath11k_pci 0000:07:00.0: qmi failed to send wlan mode off: -110 >>>> - Second after this, I commanded the unbinded (ath11_pci) and I get the >>>> warning. Let extend here the stack trace: >>>> [   24.238198]  ? free_large_kmalloc+0x57/0x90 >>>> [   24.238199]  ? report_bug+0x16b/0x180 >>>> [   24.238210]  ? handle_bug+0x3c/0x70 >>>> [   24.238218]  ? exc_invalid_op+0x14/0x70 >>>> [   24.238218]  ? asm_exc_invalid_op+0x16/0x20 >>>> [   24.238224]  ? free_large_kmalloc+0x57/0x90 >>>> [   24.238227]  ath11k_dp_free+0x99/0xb0 [ath11k] >>>> [   24.238275]  ath11k_core_deinit+0x12b/0x1a0 [ath11k] >>>> [   24.238287]  ath11k_pci_remove+0x7b/0x120 [ath11k_pci] >>>> [   24.238294]  pci_device_remove+0x3e/0xb0 >>>> [   24.238304]  device_release_driver_internal+0x193/0x200 >>>> [   24.238315]  unbind_store+0x9d/0xb0 >>>> [   24.238320]  kernfs_fop_write_iter+0x13a/0x1d0 >>>> [   24.238330]  vfs_write+0x32e/0x470 >>>> [   24.238335]  ksys_write+0x5f/0xe0 >>>> [   24.238336]  do_syscall_64+0x5f/0xe0 >>>> Very easy to reproduce. >>>> >>> >>> >>> Thanks much for the logs, that makes sense. The timestamps explain why my earlier >>> reasoning did not match the trace: unbind reaches ath11k_pci_remove() before >>> ATH11K_FLAG_QMI_FAIL is set by the QMI event worker as it is held up on wlan mode off qmi >> >> how could QMI worker set this flag? the first failure happens in >> ath12k_core_qmi_firmware_ready() and upon this failure the QMI worker just break out >> without setting any flag, no? >> > > > you mean ath1*1*k_core_qmi_firmware_ready() ?. Yes in ToT it breaks out without setting > any flags, so I proposed to set that on failure case ATH11K_QMI_EVENT_FW_READY: (similar > to case ATH11K_QMI_EVENT_FW_INIT_DONE:) in this mail thread. Hmm, I mixed it with ath12k. You are right, for ATH11K_QMI_EVENT_FW_INIT_DONE, the ATH11K_FLAG_QMI_FAIL is set upon failure. > > > -- > Ramesh