[PATCH ath-next v2 0/2] wifi: ath12k: fix peer delete race in MLO scenario
Baochen Qiang <[email protected]>
| Newsgroups | org.infradead.lists.ath12k,org.kernel.vger.linux-wireless |
|---|---|
| Message-ID | <20260629-ath12k-mlo-peer-delete-race-v2-0-362b25590d19@oss.qualcomm.com> |
Patch 1 fixes a pre-existing UAF in ath12k_mac_vdev_create()'s err_peer_del rollback path. Patch 2 fixes "Timeout in receiving peer delete response" on MLO disconnect, caused by a per-radio shared completion that gets clobbered between back-to-back WMI peer_delete sends. Signed-off-by: Baochen Qiang <[email protected]> --- Changes in v2: - rebased on ToT - patch 2/2: make ath12k_peer_delete_wait_register() and ath12k_peer_delete_wait_unregister() static to peer.c - Link to v1: https://lore.kernel.org/r/20260617-ath12k-mlo-peer-delete-race-v1-0-ab3c4f455dfb@oss.qualcomm.com --- Baochen Qiang (2): wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback wifi: ath12k: fix MLO peer delete race drivers/net/wireless/ath/ath12k/core.c | 2 +- drivers/net/wireless/ath/ath12k/core.h | 5 +- drivers/net/wireless/ath/ath12k/mac.c | 20 +---- drivers/net/wireless/ath/ath12k/peer.c | 130 ++++++++++++++++++++++++++------- drivers/net/wireless/ath/ath12k/peer.h | 14 +++- drivers/net/wireless/ath/ath12k/wmi.c | 16 ++-- 6 files changed, 133 insertions(+), 54 deletions(-) --- base-commit: 1547a99cd8d8c1ab3e04dbd92b72b3b5f7cb85a9 change-id: 20260602-ath12k-mlo-peer-delete-race-74fdaf880017 Best regards, -- Baochen Qiang <[email protected]>