Re: [PATCH 10/10] wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()

Hi Felix,

kernel test robot noticed the following build errors:

[auto build test ERROR on wireless/main]
[also build test ERROR on linus/master v7.2-rc7]
[cannot apply to wireless-next/main next-20260813]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Felix-Fietkau/wifi-mt76-mt7915-handle-MCU-PS-sync-events/20260807-020152
base:   https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git main
patch link:    https://lore.kernel.org/r/20260801145334.1166751-10-nbd%40nbd.name
patch subject: [PATCH 10/10] wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()
config: x86_64-rhel-9.4-bpf (https://download.01.org/0day-ci/archive/20260814/[email protected]/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260814/[email protected]/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/

All errors (new ones prefixed by >>):

   drivers/net/wireless/mediatek/mt76/tx.c: In function 'mt76_txq_send_burst':
>> drivers/net/wireless/mediatek/mt76/tx.c:501:21: error: implicit declaration of function 'ieee80211_txq_aql_pending'; did you mean 'ieee80211_txq_get_depth'? [-Wimplicit-function-declaration]
     501 |                 if (ieee80211_txq_aql_pending(phy->hw, txq))
         |                     ^~~~~~~~~~~~~~~~~~~~~~~~~
         |                     ieee80211_txq_get_depth


vim +501 drivers/net/wireless/mediatek/mt76/tx.c

   484	
   485	static int
   486	mt76_txq_send_burst(struct mt76_phy *phy, struct mt76_queue *q,
   487			    struct mt76_txq *mtxq, struct mt76_wcid *wcid)
   488	{
   489		struct mt76_dev *dev = phy->dev;
   490		struct ieee80211_txq *txq = mtxq_to_txq(mtxq);
   491		enum mt76_txq_id qid = mt76_txq_get_qid(txq);
   492		struct ieee80211_tx_info *info;
   493		struct sk_buff *skb;
   494		int n_frames = 1;
   495		bool stop = false;
   496		int idx;
   497	
   498		if (test_bit(MT_WCID_FLAG_PS, &wcid->flags)) {
   499			if (!(dev->drv->drv_flags & MT_DRV_HW_PS_BUFFERING))
   500				return 0;
 > 501			if (ieee80211_txq_aql_pending(phy->hw, txq))
   502				return 0;
   503		}
   504	
   505		if (atomic_read(&wcid->non_aql_packets) >= MT_MAX_NON_AQL_PKT)
   506			return 0;
   507	
   508		skb = mt76_txq_dequeue(phy, mtxq);
   509		if (!skb)
   510			return 0;
   511	
   512		info = IEEE80211_SKB_CB(skb);
   513		if (!(wcid->tx_info & MT_WCID_TX_INFO_SET))
   514			ieee80211_get_tx_rates(txq->vif, txq->sta, skb,
   515					       info->control.rates, 1);
   516	
   517		spin_lock(&q->lock);
   518		idx = __mt76_tx_queue_skb(phy, qid, skb, wcid, txq->sta, &stop);
   519		spin_unlock(&q->lock);
   520		if (idx < 0)
   521			return idx;
   522	
   523		if (test_bit(MT_WCID_FLAG_PS, &wcid->flags))
   524			goto out;
   525	
   526		do {
   527			if (test_bit(MT76_RESET, &phy->state) || phy->offchannel)
   528				break;
   529	
   530			if (stop || mt76_txq_stopped(q))
   531				break;
   532	
   533			skb = mt76_txq_dequeue(phy, mtxq);
   534			if (!skb)
   535				break;
   536	
   537			info = IEEE80211_SKB_CB(skb);
   538			if (!(wcid->tx_info & MT_WCID_TX_INFO_SET))
   539				ieee80211_get_tx_rates(txq->vif, txq->sta, skb,
   540						       info->control.rates, 1);
   541	
   542			spin_lock(&q->lock);
   543			idx = __mt76_tx_queue_skb(phy, qid, skb, wcid, txq->sta, &stop);
   544			spin_unlock(&q->lock);
   545			if (idx < 0)
   546				break;
   547	
   548			n_frames++;
   549		} while (1);
   550	
   551	out:
   552		spin_lock(&q->lock);
   553		dev->queue_ops->kick(dev, q);
   554		spin_unlock(&q->lock);
   555	
   556		return n_frames;
   557	}
   558	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki