From nobody Mon Apr 6 19:38:14 2026 Received: from mail-pf1-f180.google.com (mail-pf1-f180.google.com [209.85.210.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E5F152E1746 for ; Wed, 18 Mar 2026 06:46:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773816402; cv=none; b=ITIEJ4Wcs2Wr61E+qJ+TAKRpZAUeiArwknuWPlQqfBhkngv4GmPSsQruPIYRK+4ZgbLdlwa8a8Pdoq6lCLHZyF6+5NfdQmEkl1qjD7NCCSR0coNxYABBFxwjZWFhpvy9Ixt1CYrYHOD1NCWpSKAiLE3hDQF2oDvngAngg/mEiPU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773816402; c=relaxed/simple; bh=wvTTufyUHvLeOcDl36cL2uDZBGETrwNV+11FiFZdK3U=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=jKj54IwqjldVSaoqcP5rET0X6uxUFClMoD3EpFh33NV/hIropwKIeTiz1Msx5GZiwhNY3706dNemOGrLoLJFbYio5Ny0tF40mZl3fr82EuhRpaZbvn0wVMnGR/PEMzlu699YbyD9s+MhCLsrs0hSFocjdCvznyw0thHRpofndzQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=roeck-us.net; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=iAmMubZB; arc=none smtp.client-ip=209.85.210.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=roeck-us.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="iAmMubZB" Received: by mail-pf1-f180.google.com with SMTP id d2e1a72fcca58-8296dabef74so6172986b3a.1 for ; Tue, 17 Mar 2026 23:46:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1773816399; x=1774421199; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:sender:from:to:cc:subject:date:message-id:reply-to; bh=o4CbwMpn5fv86NkuOD8DdCT6N1212S5p3GRVvtF61FQ=; b=iAmMubZBDT989X3Pq65dMqcIFKHZkjwMIEK5qCJY1ltMMlZJejCJRGY6RQ4KLXGHrA +C4Q61491kqiK1cspBfZ6rrpI0d9jAUBgVdY+NCpzFUHnOT/9Y0mO16ZLIw+4MDvIH3A nVy8Qui5SlMa5IeFCasGcghvhUuOptXUZHmOCzLyF5YzuG/5o+33iRDVBxMWoIkqR695 rU2JXitZft1yRoeMZUtprVrx54vzw8m8GrFBVp5JGIyppr6idtiKouh8bsaHdDW9bHfa 0Lzxx0pxcR99U2jl0GM/1ccUChz2PeFUHvM9R8wV567Sw1VcMNCZdA8754JIcayYuEpt FUjA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773816399; x=1774421199; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:sender:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=o4CbwMpn5fv86NkuOD8DdCT6N1212S5p3GRVvtF61FQ=; b=GQp5jA3Dp5zVF836Ayz0tcIuPYbG0X8MfOzUslTchPtuMyqdP4znjTR9N01wIAuNK0 sAEUvzl9x59GKAGCvms11xxnesqBbfy+IgsfoswgjGFOnb7r1J8Js0RdD3aQYZRvd43l SSGqg7p265nBp/ACn+4kTMTr5NbzHlYobcimaBLS6qP2k054DHoatk83ETjKRLlAOffY L1n1FiLGiSPrWdmMawMHXOYgYN4e2wnp4q52S5kamPtR9idF4/vsrmVXM4JuFt0swwg/ 2z2CB651rExOcCxZ5A7J4GPnYlOIWJ8kRmUNIdRKFUXCG3JK2F1NGeFneuIVTXrVD92/ +jOA== X-Forwarded-Encrypted: i=1; AJvYcCXwQLDebvEnzfhpYkqQ9T/xobIpTo/f1DNY2tLNLwNA264anyATMXdkHqmvgc4X8ngEDGcBzDLijDqtWu4=@vger.kernel.org X-Gm-Message-State: AOJu0YxLkHAY0uziRDXovFuCm6LPOuBp40eG6RQmIY2Te42waLl4z9zT RcdzvGA5/Av9anR3tKzzS3D1XbB8rq80wJ3wbO8gA9DOBcKHt5f9NwUX X-Gm-Gg: ATEYQzyhF/dtJ2E9Che2KFriF2xEBZZBX8/nHlyAMK0+4N6cc+vr4xnW2wd0fEm0KOt N8vgkStVu/dD4XxnuMzrcepzhic7PXpT8n2vZu8iKYc89oyfqHCtuM2Kkz/tnZLIluqihO/wzox mcGuIbqd75oX7mu4bhwOd9uPXPjeRrpASTQFmXZzW9/QYQbyeEE+yddiyrhBRE7H1rhZPZbPPTX PleBJMDcIY7FKCVJZ/UQWw0+ElNo55xYAxmRGcHusO6h8AMrUvbZBnL3NO7Qkp/62Dnh9kbETQr 1XYe5idnJzPhYUJMkk/FgBeXHyHQ2WSlHRnM1k/E22nRL4MTVS1oxod5uTiEhFB0MAVt0B+JP4L eePO2V69g6Wk0Ol11PNVINSPbagc2oJ5xMOWMARrgKCYK5PpwPo9G96KP5RPyv2mpAIpBzpdUpl FpQ6XXAxpZC1/MtqS0dO/zYy2KScA7YV4TRdus X-Received: by 2002:a05:6a00:2342:b0:823:1c3e:95cf with SMTP id d2e1a72fcca58-82a6aca9554mr2066000b3a.18.1773816399240; Tue, 17 Mar 2026 23:46:39 -0700 (PDT) Received: from server.roeck-us.net ([2600:1700:e321:62f0:da43:aeff:fecc:bfd5]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-82a6c63808fsm1688506b3a.23.2026.03.17.23.46.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 17 Mar 2026 23:46:38 -0700 (PDT) Sender: Guenter Roeck From: Guenter Roeck To: Johannes Berg Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Guenter Roeck , Peter Astrand Subject: [PATCH] wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom Date: Tue, 17 Mar 2026 23:46:36 -0700 Message-ID: <20260318064636.3065925-1-linux@roeck-us.net> X-Mailer: git-send-email 2.45.2 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Since upstream commit e75665dd0968 ("wifi: wlcore: ensure skb headroom before skb_push"), wl1271_tx_allocate() and with it wl1271_prepare_tx_frame() returns -EAGAIN if pskb_expand_head() fails. However, in wlcore_tx_work_locked(), a return value of -EAGAIN from wl1271_prepare_tx_frame() is interpreted as the aggregation buffer being full. This causes the code to flush the buffer, put the skb back at the head of the queue, and immediately retry the same skb in a tight while loop. Because wlcore_tx_work_locked() holds wl->mutex, and the retry happens immediately with GFP_ATOMIC, this will result in an infinite loop and a CPU soft lockup. Return -ENOMEM instead so the packet is dropped and the loop terminates. The problem was found by an experimental code review agent based on gemini-3.1-pro while reviewing backports into v6.18.y. Assisted-by: Gemini:gemini-3.1-pro Fixes: e75665dd0968 ("wifi: wlcore: ensure skb headroom before skb_push") Cc: Peter Astrand Signed-off-by: Guenter Roeck --- drivers/net/wireless/ti/wlcore/tx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/ti/wlcore/tx.c b/drivers/net/wireless/ti/= wlcore/tx.c index 6241866d39df..75cfbcfb7626 100644 --- a/drivers/net/wireless/ti/wlcore/tx.c +++ b/drivers/net/wireless/ti/wlcore/tx.c @@ -210,7 +210,7 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct= wl12xx_vif *wlvif, if (skb_headroom(skb) < (total_len - skb->len) && pskb_expand_head(skb, (total_len - skb->len), 0, GFP_ATOMIC)) { wl1271_free_tx_id(wl, id); - return -EAGAIN; + return -ENOMEM; } desc =3D skb_push(skb, total_len - skb->len); =20 --=20 2.45.2