[PATCH rtw-next v3] wifi: rtw89: check return values in rtw89_ops_start_ap()

[PATCH rtw-next v3] wifi: rtw89: check return values in rtw89_ops_start_ap()

[Dmitry Morgun]

Several functions called in rtw89_ops_start_ap() may fail to allocate
skb or fail to send H2C command to firmware, returning -ENOMEM or an
error code. Their return values are ignored, so subsequent commands
are executed with incorrect state.

Check the return values and propagate errors.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: a52e4f2ce0f5 ("wifi: rtw89: implement ieee80211_ops::start_ap and stop_ap")
Signed-off-by: Dmitry Morgun <d.morgun@ispras.ru>
---
 drivers/net/wireless/realtek/rtw89/mac80211.c | 35 ++++++++++++++++---
 1 file changed, 30 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c
index 501c3af1d..cd4076a17 100644
--- a/drivers/net/wireless/realtek/rtw89/mac80211.c
+++ b/drivers/net/wireless/realtek/rtw89/mac80211.c
@@ -811,11 +811,36 @@ static int rtw89_ops_start_ap(struct ieee80211_hw *hw,
 
 	ether_addr_copy(rtwvif_link->bssid, link_conf->bssid);
 	rtw89_cam_bssid_changed(rtwdev, rtwvif_link);
-	rtw89_mac_port_update(rtwdev, rtwvif_link);
-	rtw89_chip_h2c_assoc_cmac_tbl(rtwdev, rtwvif_link, NULL);
-	rtw89_fw_h2c_role_maintain(rtwdev, rtwvif_link, NULL, RTW89_ROLE_TYPE_CHANGE);
-	rtw89_fw_h2c_join_info(rtwdev, rtwvif_link, NULL, true);
-	rtw89_fw_h2c_cam(rtwdev, rtwvif_link, NULL, NULL, RTW89_ROLE_TYPE_CHANGE);
+	ret = rtw89_mac_port_update(rtwdev, rtwvif_link);
+	if (ret) {
+		rtw89_warn(rtwdev, "failed to update mac port\n");
+		return ret;
+	}
+
+	ret = rtw89_chip_h2c_assoc_cmac_tbl(rtwdev, rtwvif_link, NULL);
+	if (ret) {
+		rtw89_warn(rtwdev, "failed to send h2c cmac table\n");
+		return ret;
+	}
+
+	ret = rtw89_fw_h2c_role_maintain(rtwdev, rtwvif_link, NULL, RTW89_ROLE_TYPE_CHANGE);
+	if (ret) {
+		rtw89_warn(rtwdev, "failed to send h2c role info\n");
+		return ret;
+	}
+
+	ret = rtw89_fw_h2c_join_info(rtwdev, rtwvif_link, NULL, true);
+	if (ret) {
+		rtw89_warn(rtwdev, "failed to send h2c join info\n");
+		return ret;
+	}
+
+	ret = rtw89_fw_h2c_cam(rtwdev, rtwvif_link, NULL, NULL, RTW89_ROLE_TYPE_CHANGE);
+	if (ret) {
+		rtw89_warn(rtwdev, "failed to send h2c cam\n");
+		return ret;
+	}
+
 	rtw89_chip_rfk_channel(rtwdev, rtwvif_link);
 
 	if (RTW89_CHK_FW_FEATURE(NOTIFY_AP_INFO, &rtwdev->fw)) {
-- 
2.34.1

RE: [PATCH rtw-next v3] wifi: rtw89: check return values in rtw89_ops_start_ap()

[Ping-Ke Shih]

Dmitry Morgun <d.morgun@ispras.ru> wrote:
> Subject: [PATCH rtw-next v3] wifi: rtw89: check return values in rtw89_ops_start_ap()

Patch is fine. But I don't remember why this is v3. Can you point out
v1 and v2?

> Several functions called in rtw89_ops_start_ap() may fail to allocate
> skb or fail to send H2C command to firmware, returning -ENOMEM or an
> error code. Their return values are ignored, so subsequent commands
> are executed with incorrect state.
> 
> Check the return values and propagate errors.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: a52e4f2ce0f5 ("wifi: rtw89: implement ieee80211_ops::start_ap and stop_ap")
> Signed-off-by: Dmitry Morgun <d.morgun@ispras.ru>

Acked-by: Ping-Ke Shih <pkshih@realtek.com>

Re: [PATCH rtw-next v3] wifi: rtw89: check return values in rtw89_ops_start_ap()

[Ping-Ke Shih]

Dmitry Morgun <d.morgun@ispras.ru> wrote:

> Several functions called in rtw89_ops_start_ap() may fail to allocate
> skb or fail to send H2C command to firmware, returning -ENOMEM or an
> error code. Their return values are ignored, so subsequent commands
> are executed with incorrect state.
> 
> Check the return values and propagate errors.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: a52e4f2ce0f5 ("wifi: rtw89: implement ieee80211_ops::start_ap and stop_ap")
> Signed-off-by: Dmitry Morgun <d.morgun@ispras.ru>
> Acked-by: Ping-Ke Shih <pkshih@realtek.com>

1 patch(es) applied to rtw-next branch of rtw.git, thanks.

a8cddb62c573 wifi: rtw89: check return values in rtw89_ops_start_ap()

---
https://github.com/pkshih/rtw.git

Re: [PATCH rtw-next v3] wifi: rtw89: check return values in rtw89_ops_start_ap()

[d.morgun]

Hi Ping-Ke,

Sorry for the confusion. The v3 suffix was added by mistake during local 
iterations of the patch.

There is no public v1/v2 in the mailing list history. This is the first 
version submitted upstream.

I will resend as v1 if needed.

Best regards,
Dmitry

Ping-Ke Shih писал(а) 2026-06-30 03:27:
> Dmitry Morgun <d.morgun@ispras.ru> wrote:
>> Subject: [PATCH rtw-next v3] wifi: rtw89: check return values in 
>> rtw89_ops_start_ap()
> 
> Patch is fine. But I don't remember why this is v3. Can you point out
> v1 and v2?
> 
>> Several functions called in rtw89_ops_start_ap() may fail to allocate
>> skb or fail to send H2C command to firmware, returning -ENOMEM or an
>> error code. Their return values are ignored, so subsequent commands
>> are executed with incorrect state.
>> 
>> Check the return values and propagate errors.
>> 
>> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>> 
>> Fixes: a52e4f2ce0f5 ("wifi: rtw89: implement ieee80211_ops::start_ap 
>> and stop_ap")
>> Signed-off-by: Dmitry Morgun <d.morgun@ispras.ru>
> 
> Acked-by: Ping-Ke Shih <pkshih@realtek.com>

RE: [PATCH rtw-next v3] wifi: rtw89: check return values in rtw89_ops_start_ap()

[Ping-Ke Shih]

d.morgun@ispras.ru <d.morgun@ispras.ru> wrote:
> Hi Ping-Ke,
> 
> Sorry for the confusion. The v3 suffix was added by mistake during local
> iterations of the patch.
> 
> There is no public v1/v2 in the mailing list history. This is the first
> version submitted upstream.
> 
> I will resend as v1 if needed.

No need to resend. I have merged this patch. 

Thanks
Ping-Ke