From nobody Thu Apr 2 08:02:55 2026 Received: from forward103a.mail.yandex.net (forward103a.mail.yandex.net [178.154.239.86]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A6D223570CC; Thu, 12 Feb 2026 12:18:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=178.154.239.86 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770898702; cv=none; b=pJGKCLv25KRdlcENiDMC73I/jFWl+l8MsXIWfair8UdPs9pCZhjhQgsX4cotBz8B5LvXLnc+m7pWs/KXn/EkMbNcI0QL5UguScIrL7UD3ex58BvcNAM4/JuA+/bSsf6/ZuDX4sDmCzr3ri9MJV0//5VI/ttu9HZN8jPvV3SWAXg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770898702; c=relaxed/simple; bh=TWtniP21rK8Dr4OoTKS6jMFec9BtEszxfgXu6Kn3fZg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=TrJstTn0hPWj/A1WWnFlOQuZAlNwudzQOy62whh6d0jou+7jSApGuTRBnMlKYspTOYfjMzkNFQHUamqzW/95KR5UkX2XnNE6L294QHfn9ha+VlocYC51LaAjGnh9rgLNcDHnbP6uH/htv6t731lnHh98L+CWlmJRzyqzj9e+SJA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru; spf=pass smtp.mailfrom=yandex.ru; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b=DODzoQRI; arc=none smtp.client-ip=178.154.239.86 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=yandex.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b="DODzoQRI" Received: from mail-nwsmtp-smtp-production-main-59.iva.yp-c.yandex.net (mail-nwsmtp-smtp-production-main-59.iva.yp-c.yandex.net [IPv6:2a02:6b8:c0c:489d:0:640:baa6:0]) by forward103a.mail.yandex.net (Yandex) with ESMTPS id A7CB380BFE; Thu, 12 Feb 2026 15:18:11 +0300 (MSK) Received: by mail-nwsmtp-smtp-production-main-59.iva.yp-c.yandex.net (smtp/Yandex) with ESMTPSA id pHTFRX8GA8c0-aRdntUwY; Thu, 12 Feb 2026 15:18:11 +0300 X-Yandex-Fwd: 1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1770898691; bh=jrz4g1phh87EGonmqHIlMvyC8hpNoCLcKt+puwxL+DI=; h=Message-ID:Date:In-Reply-To:Cc:Subject:References:To:From; b=DODzoQRID1zaSfJjJi1VYb2/uQrmgOAN6zh5ELqXJnft6rpu1/eslJqrUbhGBRdDD tWVYxRzhVkmMydciWoffGJNP0Ssj+Ncf0IltWtUgwrbVAw6Uw1H6x7XWKucwogx0Pc AYt8o/W2vhDbAltMQQDzGvpL/UrMHMKAaGruh3ck= Authentication-Results: mail-nwsmtp-smtp-production-main-59.iva.yp-c.yandex.net; dkim=pass header.i=@yandex.ru From: m.limarencko@yandex.ru To: jjohnson@kernel.org Cc: linux-wireless@vger.kernel.org, ath12k@lists.infradead.org, linux-kernel@vger.kernel.org, Mikhail Limarenko Subject: [PATCH ath-next v2 1/4] wifi: ath12k: return error when survey frequency is not found Date: Thu, 12 Feb 2026 15:17:43 +0300 Message-ID: <20260212121746.329619-2-m.limarencko@yandex.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260212121746.329619-1-m.limarencko@yandex.ru> References: <20260212121746.329619-1-m.limarencko@yandex.ru> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Mikhail Limarenko freq_to_idx() currently returns a trailing synthetic index when the requested channel frequency is not found. chan-info handlers already bound-check survey index, but an explicit error on no-match keeps semantics clear and avoids propagating a fake index value. Keep matched-frequency index progression unchanged, return -ENOENT on no match, and make callers reject negative indexes. Tested-on: QCNFA765 (WCN785x), kernel 6.18.5+deb13-amd64 Signed-off-by: Mikhail Limarenko --- v2: - drop out-of-bounds claim from commit message - keep original index progression for matched frequencies - return explicit -ENOENT on no-match and reject negative idx in callers drivers/net/wireless/ath/ath12k/wmi.c | 9 +++------ 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/a= th/ath12k/wmi.c index e647b84..a2f8a7c 100644 --- a/drivers/net/wireless/ath/ath12k/wmi.c +++ b/drivers/net/wireless/ath/ath12k/wmi.c @@ -6528,12 +6528,11 @@ static int freq_to_idx(struct ath12k *ar, int freq) continue; =20 if (sband->channels[ch].center_freq =3D=3D freq) - goto exit; + return idx; } } =20 -exit: - return idx; + return -ENOENT; } =20 static int ath12k_pull_chan_info_ev(struct ath12k_base *ab, struct sk_buff= *skb, @@ -7475,7 +7474,7 @@ static void ath12k_chan_info_event(struct ath12k_base= *ab, struct sk_buff *skb) } =20 idx =3D freq_to_idx(ar, le32_to_cpu(ch_info_ev.freq)); - if (idx >=3D ARRAY_SIZE(ar->survey)) { + if (idx < 0 || idx >=3D ARRAY_SIZE(ar->survey)) { ath12k_warn(ab, "chan info: invalid frequency %d (idx %d out of bounds)\= n", ch_info_ev.freq, idx); goto exit; @@ -7550,7 +7549,7 @@ ath12k_pdev_bss_chan_info_event(struct ath12k_base *a= b, struct sk_buff *skb) =20 spin_lock_bh(&ar->data_lock); idx =3D freq_to_idx(ar, le32_to_cpu(bss_ch_info_ev.freq)); - if (idx >=3D ARRAY_SIZE(ar->survey)) { + if (idx < 0 || idx >=3D ARRAY_SIZE(ar->survey)) { ath12k_warn(ab, "bss chan info: invalid frequency %d (idx %d out of boun= ds)\n", bss_ch_info_ev.freq, idx); goto exit; --=20 2.47.3 From nobody Thu Apr 2 08:02:55 2026 Received: from forward103b.mail.yandex.net (forward103b.mail.yandex.net [178.154.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 803D027E7EB; Thu, 12 Feb 2026 12:18:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=178.154.239.150 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770898696; cv=none; b=Swj6EDF9uvjw7oz0A8N0ecIRBfPrUOLsronxzfAzg1L74QGp25ZupVAHQubO6tSwW+5CLQsXplZZ8yRUszNVTM617IqG2/6WxPrrDWyC2kaA7m7lvuFbTYqECWoTnubxImga/ucPtqx8pKeULFnGDXrTHGZ377F0ue424TgYKrg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770898696; c=relaxed/simple; bh=rcvmteF2gb00/oqKLKmzLGtIPzHXzW289FycTseOWss=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=QmfNs9IIz98O051dS6mpkuY3qgwcOakfGxx2RC2LKLVDK5hhOUqlxKwIglqHAV7jOi4QS77YgmiowNEjcBbWQB7jW89UNvjWM9waxcIieryn9nuK2+aU6jtK5kArXaXXy0cGZosGF+ORqKzRT+6nE8GqEvWmoAsDkF+367fNbAQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru; spf=pass smtp.mailfrom=yandex.ru; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b=TvdTRXAc; arc=none smtp.client-ip=178.154.239.150 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=yandex.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b="TvdTRXAc" Received: from mail-nwsmtp-smtp-production-main-59.iva.yp-c.yandex.net (mail-nwsmtp-smtp-production-main-59.iva.yp-c.yandex.net [IPv6:2a02:6b8:c0c:489d:0:640:baa6:0]) by forward103b.mail.yandex.net (Yandex) with ESMTPS id 4D0A2C007E; Thu, 12 Feb 2026 15:18:12 +0300 (MSK) Received: by mail-nwsmtp-smtp-production-main-59.iva.yp-c.yandex.net (smtp/Yandex) with ESMTPSA id pHTFRX8GA8c0-h1HwsZxp; Thu, 12 Feb 2026 15:18:11 +0300 X-Yandex-Fwd: 1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1770898691; bh=58gkicXTfl/yMiEWBrqSzSMvFG/0h6/5ysLXoi5qXWA=; h=Message-ID:Date:In-Reply-To:Cc:Subject:References:To:From; b=TvdTRXAcO1PmjczGP7Wx2IZiO19UB5rrORIqm4Pj7yOEebGnKLSKWB+kfDVW805zL 39Dbm/LjkpDPqhQCoqGNHudwaGf/LB5MeBoIS3akIBO/tmBFJ5MwLLqvJTyLnd6Oji MICvpjVlq67xpkxZoCswzQqstZjSi7ZYPEkNf9pc= Authentication-Results: mail-nwsmtp-smtp-production-main-59.iva.yp-c.yandex.net; dkim=pass header.i=@yandex.ru From: m.limarencko@yandex.ru To: jjohnson@kernel.org Cc: linux-wireless@vger.kernel.org, ath12k@lists.infradead.org, linux-kernel@vger.kernel.org, Mikhail Limarenko Subject: [PATCH ath-next v2 2/4] wifi: ath12k: avoid long fw_stats waits on vdev stats hot path Date: Thu, 12 Feb 2026 15:17:44 +0300 Message-ID: <20260212121746.329619-3-m.limarencko@yandex.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260212121746.329619-1-m.limarencko@yandex.ru> References: <20260212121746.329619-1-m.limarencko@yandex.ru> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Mikhail Limarenko Station info requests can trigger frequent VDEV stat pulls from user space (iw/NM polling). On affected firmware, waiting 3 seconds for fw_stats_done causes repeated stalls and visible hitches. Use a short timeout for VDEV_STAT requests and skip unnecessary waits for stats types that do not need completion synchronization. Tested-on: QCNFA765 (WCN785x), kernel 6.18.5+deb13-amd64 Signed-off-by: Mikhail Limarenko --- drivers/net/wireless/ath/ath12k/mac.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/a= th/ath12k/mac.c index 095b49a..1b550e9 100644 --- a/drivers/net/wireless/ath/ath12k/mac.c +++ b/drivers/net/wireless/ath/ath12k/mac.c @@ -4829,6 +4829,7 @@ int ath12k_mac_get_fw_stats(struct ath12k *ar, { struct ath12k_base *ab =3D ar->ab; struct ath12k_hw *ah =3D ath12k_ar_to_ah(ar); + unsigned long done_timeout =3D 3 * HZ; unsigned long time_left; int ret; =20 @@ -4859,15 +4860,32 @@ int ath12k_mac_get_fw_stats(struct ath12k *ar, return -ETIMEDOUT; } =20 + /* VDEV stats are queried frequently from station info paths (e.g. iw/NM). + * On buggy firmware this path can timeout repeatedly and block callers f= or + * multiple seconds; keep the hot path responsive while preserving behavi= or + * for other stats types. + */ + if (param->stats_id & WMI_REQUEST_VDEV_STAT) + done_timeout =3D msecs_to_jiffies(200); + + /* Non-vdev/bcn stats are handled in a single event. */ + if (!(param->stats_id & (WMI_REQUEST_VDEV_STAT | WMI_REQUEST_BCN_STAT))) + return 0; + /* Firmware sends WMI_UPDATE_STATS_EVENTID back-to-back * when stats data buffer limit is reached. fw_stats_complete * is completed once host receives first event from firmware, but * still there could be more events following. Below is to wait * until firmware completes sending all the events. */ - time_left =3D wait_for_completion_timeout(&ar->fw_stats_done, 3 * HZ); + time_left =3D wait_for_completion_timeout(&ar->fw_stats_done, done_timeou= t); if (!time_left) { - ath12k_warn(ab, "time out while waiting for fw stats done\n"); + if (param->stats_id & WMI_REQUEST_VDEV_STAT) + ath12k_dbg(ab, ATH12K_DBG_WMI, + "time out while waiting for fw stats done (stats_id 0x%x)\n", + param->stats_id); + else + ath12k_warn(ab, "time out while waiting for fw stats done\n"); return -ETIMEDOUT; } =20 --=20 2.47.3 From nobody Thu Apr 2 08:02:55 2026 Received: from forward203a.mail.yandex.net (forward203a.mail.yandex.net [178.154.239.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9B9883570B6; Thu, 12 Feb 2026 12:24:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=178.154.239.90 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770899079; cv=none; b=RK5e9GKPpNo8GLh66wnndz2fmneOVWz8RPCAdzW4/pGJtyeKx+qA/2PF4TFs6vNoqXcY8QwfEYcMpn0vOVeJWSVfo6mVSwXBV9JM/IpugvodLDb9/G6jOmB4Re0+5wAynxSRhe4KGg2qY02vEthYxbX3JE6o7dAr7fJjvvdKamc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770899079; c=relaxed/simple; bh=yiIjT8QBpch/u0ui/vy8LKtqe7lHi4xzIoxFhBemH7s=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=C8LuX4QhSbA3z6E1o1m5LWiNh18NT/axYDLRwXaJv6OydQFdLN2vGcEhgW7REX6xUmh256O+sQmbzzU0872JoOYY53rBAMWH232RPXV05ELkesaLIF/3daQq6UDjWbqMkWsF+hhHXiZrvbgLwDZOtCexagetkR1QaUuN+mx35NA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru; spf=pass smtp.mailfrom=yandex.ru; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b=VUxcVIRy; arc=none smtp.client-ip=178.154.239.90 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=yandex.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b="VUxcVIRy" Received: from forward102a.mail.yandex.net (forward102a.mail.yandex.net [IPv6:2a02:6b8:c0e:500:1:45:d181:d102]) by forward203a.mail.yandex.net (Yandex) with ESMTPS id CACDD85232; Thu, 12 Feb 2026 15:18:20 +0300 (MSK) Received: from mail-nwsmtp-smtp-production-main-59.iva.yp-c.yandex.net (mail-nwsmtp-smtp-production-main-59.iva.yp-c.yandex.net [IPv6:2a02:6b8:c0c:489d:0:640:baa6:0]) by forward102a.mail.yandex.net (Yandex) with ESMTPS id 0EA7EC00A5; Thu, 12 Feb 2026 15:18:13 +0300 (MSK) Received: by mail-nwsmtp-smtp-production-main-59.iva.yp-c.yandex.net (smtp/Yandex) with ESMTPSA id pHTFRX8GA8c0-u7ochj6i; Thu, 12 Feb 2026 15:18:12 +0300 X-Yandex-Fwd: 1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1770898692; bh=vhPBz7+tj7yd+44S6wLmgT5a0ZZddDSRoKD28qCw7Ps=; h=Message-ID:Date:In-Reply-To:Cc:Subject:References:To:From; b=VUxcVIRyUZ1/WkJ7Adv4LbqDVHTj/bnZiBqZY5aAKoF0Q9zKzCLr3oOnXW8ZS+GIz szcf86fjCfY7pC4rkiPvVr7PCPmABHXAaAZVl/i0Zc7+9W9G8Hi/k9KhTeBpzVb4nN dgABOC9/mIg4xDmJFqauYoCgTrntjU2VYGlclutM= Authentication-Results: mail-nwsmtp-smtp-production-main-59.iva.yp-c.yandex.net; dkim=pass header.i=@yandex.ru From: m.limarencko@yandex.ru To: jjohnson@kernel.org Cc: linux-wireless@vger.kernel.org, ath12k@lists.infradead.org, linux-kernel@vger.kernel.org, Mikhail Limarenko Subject: [PATCH ath-next v2 3/4] wifi: ath12k: sanitize invalid MCS metadata in rx path Date: Thu, 12 Feb 2026 15:17:45 +0300 Message-ID: <20260212121746.329619-4-m.limarencko@yandex.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260212121746.329619-1-m.limarencko@yandex.ru> References: <20260212121746.329619-1-m.limarencko@yandex.ru> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Mikhail Limarenko Malformed or unsupported rate metadata from firmware can carry invalid MCS values into mac80211 status handling. This was observed with HE MCS=3D12 and coincided with ieee80211_rx_list warnings. When MCS is out of range, fall back to legacy metadata and use ratelimited diagnostics. Tested-on: QCNFA765 (WCN785x), kernel 6.18.5+deb13-amd64 Signed-off-by: Mikhail Limarenko --- drivers/net/wireless/ath/ath12k/dp_rx.c | 39 +++++++++++++++---------- 1 file changed, 23 insertions(+), 16 deletions(-) diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless= /ath/ath12k/dp_rx.c index 99d29ed..f0c56a9 100644 --- a/drivers/net/wireless/ath/ath12k/dp_rx.c +++ b/drivers/net/wireless/ath/ath12k/dp_rx.c @@ -2534,9 +2534,11 @@ static void ath12k_dp_rx_h_rate(struct ath12k *ar, s= truct ath12k_dp_rx_info *rx_ case RX_MSDU_START_PKT_TYPE_11N: rx_status->encoding =3D RX_ENC_HT; if (rate_mcs > ATH12K_HT_MCS_MAX) { - ath12k_warn(ar->ab, - "Received with invalid mcs in HT mode %d\n", - rate_mcs); + dev_warn_ratelimited(ar->ab->dev, + "ath12k: invalid HT mcs %u, forcing legacy rate metadata\n", + rate_mcs); + rx_status->encoding =3D RX_ENC_LEGACY; + rx_status->rate_idx =3D 0; break; } rx_status->rate_idx =3D rate_mcs + (8 * (nss - 1)); @@ -2546,42 +2548,47 @@ static void ath12k_dp_rx_h_rate(struct ath12k *ar, = struct ath12k_dp_rx_info *rx_ break; case RX_MSDU_START_PKT_TYPE_11AC: rx_status->encoding =3D RX_ENC_VHT; - rx_status->rate_idx =3D rate_mcs; if (rate_mcs > ATH12K_VHT_MCS_MAX) { - ath12k_warn(ar->ab, - "Received with invalid mcs in VHT mode %d\n", - rate_mcs); + dev_warn_ratelimited(ar->ab->dev, + "ath12k: invalid VHT mcs %u, forcing legacy rate metadata\n", + rate_mcs); + rx_status->encoding =3D RX_ENC_LEGACY; + rx_status->rate_idx =3D 0; break; } + rx_status->rate_idx =3D rate_mcs; rx_status->nss =3D nss; if (sgi) rx_status->enc_flags |=3D RX_ENC_FLAG_SHORT_GI; rx_status->bw =3D ath12k_mac_bw_to_mac80211_bw(bw); break; case RX_MSDU_START_PKT_TYPE_11AX: - rx_status->rate_idx =3D rate_mcs; if (rate_mcs > ATH12K_HE_MCS_MAX) { - ath12k_warn(ar->ab, - "Received with invalid mcs in HE mode %d\n", - rate_mcs); + dev_warn_ratelimited(ar->ab->dev, + "ath12k: invalid HE mcs %u, forcing legacy rate metadata\n", + rate_mcs); + rx_status->encoding =3D RX_ENC_LEGACY; + rx_status->rate_idx =3D 0; break; } rx_status->encoding =3D RX_ENC_HE; + rx_status->rate_idx =3D rate_mcs; rx_status->nss =3D nss; rx_status->he_gi =3D ath12k_he_gi_to_nl80211_he_gi(sgi); rx_status->bw =3D ath12k_mac_bw_to_mac80211_bw(bw); break; case RX_MSDU_START_PKT_TYPE_11BE: - rx_status->rate_idx =3D rate_mcs; - if (rate_mcs > ATH12K_EHT_MCS_MAX) { - ath12k_warn(ar->ab, - "Received with invalid mcs in EHT mode %d\n", - rate_mcs); + dev_warn_ratelimited(ar->ab->dev, + "ath12k: invalid EHT mcs %u, forcing legacy rate metadata\n", + rate_mcs); + rx_status->encoding =3D RX_ENC_LEGACY; + rx_status->rate_idx =3D 0; break; } =20 rx_status->encoding =3D RX_ENC_EHT; + rx_status->rate_idx =3D rate_mcs; rx_status->nss =3D nss; rx_status->eht.gi =3D ath12k_mac_eht_gi_to_nl80211_eht_gi(sgi); rx_status->bw =3D ath12k_mac_bw_to_mac80211_bw(bw); --=20 2.47.3 From nobody Thu Apr 2 08:02:55 2026 Received: from forward100b.mail.yandex.net (forward100b.mail.yandex.net [178.154.239.147]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9920834C9B7; Thu, 12 Feb 2026 12:18:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=178.154.239.147 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770898703; cv=none; b=dVVxfI+H9LK0DQTt4wJiMpE8zsaNvR786SdC1GrqMXLzY+reuk41j6FBwWT/TgcKD7MzSfim0xFTZV3dffJz5bFOPGuaMWC95Za9Ib+t9GCxtZ2sbTVi6AA/qyB8Bv8omdErhLDTpm1H2Z/lrSjD5yvu5lUGKxgsLOpyjaPqamM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770898703; c=relaxed/simple; bh=i8e0Z5t7th9323WCkMyYpegZ/+lKN0RTpwAEcQcJNzs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=d9gpwv1ApjoOBO6/V0aLndtcAh1XGhLrXI2jxrv1gP2v0/XSnrc9bYc/v9VJZnVK8CrqDQxqJ6JVSQdDC29aTDaY2t0J/xqLOrmiLHdh2O6FPquf1q07PNPsXeNpwOaTjUh6Vrqf7YOeWTYaK0Ks+vqq8PcYHQ9wJ15/kgESrw8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru; spf=pass smtp.mailfrom=yandex.ru; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b=jFaq76L8; arc=none smtp.client-ip=178.154.239.147 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=yandex.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b="jFaq76L8" Received: from mail-nwsmtp-smtp-production-main-59.iva.yp-c.yandex.net (mail-nwsmtp-smtp-production-main-59.iva.yp-c.yandex.net [IPv6:2a02:6b8:c0c:489d:0:640:baa6:0]) by forward100b.mail.yandex.net (Yandex) with ESMTPS id 0798A80719; Thu, 12 Feb 2026 15:18:14 +0300 (MSK) Received: by mail-nwsmtp-smtp-production-main-59.iva.yp-c.yandex.net (smtp/Yandex) with ESMTPSA id pHTFRX8GA8c0-5PwIjyTc; Thu, 12 Feb 2026 15:18:13 +0300 X-Yandex-Fwd: 1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1770898693; bh=l2rzyeifuTvLESFEtUsG8awO2sxZc/zhl6syNBHYDnA=; h=Message-ID:Date:In-Reply-To:Cc:Subject:References:To:From; b=jFaq76L8RYZUuxPYqoq9iKSkTBA4PZsTVybY+i+IHmbYbJQROVKW0tQYdqIOE1vHQ CHWbt2n2RL6jD3GaH9W2wZzKNZbJ+XFHYOrRgGCluTBhSPfELSjJ9EOgCHv1/yW2mK EaLzyjXgI2fzHZte0Jn4SS4W8AdnDuZvXKlD2qvc= Authentication-Results: mail-nwsmtp-smtp-production-main-59.iva.yp-c.yandex.net; dkim=pass header.i=@yandex.ru From: m.limarencko@yandex.ru To: jjohnson@kernel.org Cc: linux-wireless@vger.kernel.org, ath12k@lists.infradead.org, linux-kernel@vger.kernel.org, Mikhail Limarenko Subject: [PATCH ath-next v2 4/4] wifi: ath12k: sanitize invalid MCS metadata in monitor rx path Date: Thu, 12 Feb 2026 15:17:46 +0300 Message-ID: <20260212121746.329619-5-m.limarencko@yandex.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260212121746.329619-1-m.limarencko@yandex.ru> References: <20260212121746.329619-1-m.limarencko@yandex.ru> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Mikhail Limarenko Apply the same invalid-MCS hardening in monitor path status conversion to keep metadata handling consistent in both data and monitor pipelines. Tested-on: QCNFA765 (WCN785x), kernel 6.18.5+deb13-amd64 Signed-off-by: Mikhail Limarenko --- drivers/net/wireless/ath/ath12k/dp_mon.c | 38 ++++++++++++++---------- 1 file changed, 23 insertions(+), 15 deletions(-) diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireles= s/ath/ath12k/dp_mon.c index 009c495..6e894ef 100644 --- a/drivers/net/wireless/ath/ath12k/dp_mon.c +++ b/drivers/net/wireless/ath/ath12k/dp_mon.c @@ -1922,9 +1922,11 @@ ath12k_dp_mon_fill_rx_rate(struct ath12k *ar, case RX_MSDU_START_PKT_TYPE_11N: rx_status->encoding =3D RX_ENC_HT; if (rate_mcs > ATH12K_HT_MCS_MAX) { - ath12k_warn(ar->ab, - "Received with invalid mcs in HT mode %d\n", - rate_mcs); + dev_warn_ratelimited(ar->ab->dev, + "ath12k: invalid HT mcs %u in monitor path, forcing legacy rate = metadata\n", + rate_mcs); + rx_status->encoding =3D RX_ENC_LEGACY; + rx_status->rate_idx =3D 0; break; } rx_status->rate_idx =3D rate_mcs + (8 * (nss - 1)); @@ -1933,35 +1935,41 @@ ath12k_dp_mon_fill_rx_rate(struct ath12k *ar, break; case RX_MSDU_START_PKT_TYPE_11AC: rx_status->encoding =3D RX_ENC_VHT; - rx_status->rate_idx =3D rate_mcs; if (rate_mcs > ATH12K_VHT_MCS_MAX) { - ath12k_warn(ar->ab, - "Received with invalid mcs in VHT mode %d\n", - rate_mcs); + dev_warn_ratelimited(ar->ab->dev, + "ath12k: invalid VHT mcs %u in monitor path, forcing legacy rate= metadata\n", + rate_mcs); + rx_status->encoding =3D RX_ENC_LEGACY; + rx_status->rate_idx =3D 0; break; } + rx_status->rate_idx =3D rate_mcs; if (sgi) rx_status->enc_flags |=3D RX_ENC_FLAG_SHORT_GI; break; case RX_MSDU_START_PKT_TYPE_11AX: - rx_status->rate_idx =3D rate_mcs; if (rate_mcs > ATH12K_HE_MCS_MAX) { - ath12k_warn(ar->ab, - "Received with invalid mcs in HE mode %d\n", - rate_mcs); + dev_warn_ratelimited(ar->ab->dev, + "ath12k: invalid HE mcs %u in monitor path, forcing legacy rate = metadata\n", + rate_mcs); + rx_status->encoding =3D RX_ENC_LEGACY; + rx_status->rate_idx =3D 0; break; } + rx_status->rate_idx =3D rate_mcs; rx_status->encoding =3D RX_ENC_HE; rx_status->he_gi =3D ath12k_he_gi_to_nl80211_he_gi(sgi); break; case RX_MSDU_START_PKT_TYPE_11BE: - rx_status->rate_idx =3D rate_mcs; if (rate_mcs > ATH12K_EHT_MCS_MAX) { - ath12k_warn(ar->ab, - "Received with invalid mcs in EHT mode %d\n", - rate_mcs); + dev_warn_ratelimited(ar->ab->dev, + "ath12k: invalid EHT mcs %u in monitor path, forcing legacy rate= metadata\n", + rate_mcs); + rx_status->encoding =3D RX_ENC_LEGACY; + rx_status->rate_idx =3D 0; break; } + rx_status->rate_idx =3D rate_mcs; rx_status->encoding =3D RX_ENC_EHT; rx_status->he_gi =3D ath12k_he_gi_to_nl80211_he_gi(sgi); break; --=20 2.47.3