Re: [PATCH ath-current v2] wifi: ath11k: fix locking problem in ath11k_dp_rx_tid_del_func()
Rameshkumar Sundaram <[email protected]>
| Newsgroups | org.kernel.vger.linux-wireless,org.infradead.lists.ath11k |
|---|---|
| Message-ID | <[email protected]> |
On 8/13/2026 5:45 PM, Nicolas Escande wrote:
> In this function, we iterate over dp->reo_cmd_cache_flush_list using
> list_for_each_entry_safe(), under dp->reo_cmd_lock for concurrent access,
> and for each expired entries we :
> - drop the lock
> - call ath11k_dp_reo_cache_flush()
> - kfree() the entry
> - retake the lock to keep on iterating
>
> list_for_each_entry_safe() protects us from deleting the entry during
> iteration but doesn't protect for concurrent access. So another thread can
> take the lock and modify the list in between and crash like below.
>
> To fix the issue, move all entries that needs to be freed to a local list
> while under the lock and then iterate over the list to free the entries
> without holding the lock.
>
> BUG: Unable to handle kernel paging request at virtual address 00000010ddbeef8c
> Call trace:
> ath11k_dp_rx_tid_del_func+0x164/0x3c8
> ath11k_dp_process_reo_status+0x1d4/0x2fc
> ath11k_dp_service_srng+0x334/0x338
> ath11k_pcic_ext_grp_napi_poll+0x30/0xc0
> __napi_poll+0x34/0x184
> napi_threaded_poll+0xb4/0x1d8
> kthread+0xdc/0xe0
> ret_from_fork+0x10/0x20
>
> Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1
>
> Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
> Suggested-by: Baochen Qiang <[email protected]>
> Signed-off-by: Nicolas Escande <[email protected]>
Reviewed-by: Rameshkumar Sundaram <[email protected]>