In iwlagn_tx_agg_start(), call iwlagn_dealloc_agg_txq()
to clear bit on error paths.

Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
---
 drivers/net/wireless/intel/iwlwifi/dvm/tx.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/tx.c b/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
index a7806776a51e..8357bcf0d05e 100644
--- a/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
@@ -604,8 +604,10 @@ int iwlagn_tx_agg_start(struct iwl_priv *priv, struct ieee80211_vif *vif,
 	}
 
 	ret = iwl_sta_tx_modify_enable_tid(priv, sta_id, tid);
-	if (ret)
+	if (ret) {
+		iwlagn_dealloc_agg_txq(priv, txq_id);
 		return ret;
+	}
 
 	spin_lock_bh(&priv->sta_lock);
 	tid_data = &priv->tid_data[sta_id][tid];
@@ -624,6 +626,7 @@ int iwlagn_tx_agg_start(struct iwl_priv *priv, struct ieee80211_vif *vif,
 				    "next_reclaimed = %d\n",
 				    tid_data->agg.ssn,
 				    tid_data->next_reclaimed);
+		iwlagn_dealloc_agg_txq(priv, txq_id);
 		tid_data->agg.state = IWL_EMPTYING_HW_QUEUE_ADDBA;
 	}
 	spin_unlock_bh(&priv->sta_lock);
-- 
2.25.1

> -----Original Message-----
> From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
> Sent: Monday, March 30, 2026 4:26 AM
> To: Korenblit, Miriam Rachel <miriam.rachel.korenblit@intel.com>; Berg,
> Johannes <johannes.berg@intel.com>
> Cc: linux-wireless@vger.kernel.org; linux-kernel@vger.kernel.org; Haoxiang Li
> <lihaoxiang@isrc.iscas.ac.cn>
> Subject: [PATCH] iwlwifi: dvm: add missing cleaup for on error path
> 
> In iwlagn_tx_agg_start(), call iwlagn_dealloc_agg_txq() to clear bit on error paths.
> 
> Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
> ---
>  drivers/net/wireless/intel/iwlwifi/dvm/tx.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
> b/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
> index a7806776a51e..8357bcf0d05e 100644
> --- a/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
> +++ b/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
> @@ -604,8 +604,10 @@ int iwlagn_tx_agg_start(struct iwl_priv *priv, struct
> ieee80211_vif *vif,
>  	}
> 
>  	ret = iwl_sta_tx_modify_enable_tid(priv, sta_id, tid);
> -	if (ret)
> +	if (ret) {
> +		iwlagn_dealloc_agg_txq(priv, txq_id);
>  		return ret;
> +	}
> 
>  	spin_lock_bh(&priv->sta_lock);
>  	tid_data = &priv->tid_data[sta_id][tid]; @@ -624,6 +626,7 @@ int
> iwlagn_tx_agg_start(struct iwl_priv *priv, struct ieee80211_vif *vif,
>  				    "next_reclaimed = %d\n",
>  				    tid_data->agg.ssn,
>  				    tid_data->next_reclaimed);
> +		iwlagn_dealloc_agg_txq(priv, txq_id);

I don't think that this is an error case?
>  		tid_data->agg.state = IWL_EMPTYING_HW_QUEUE_ADDBA;
>  	}
>  	spin_unlock_bh(&priv->sta_lock);
> --
> 2.25.1