From nobody Mon Sep 28 05:49:54 2026 Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0BB5848EBFE for ; Tue, 25 Aug 2026 23:18:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787699923; cv=none; b=BWkSLq1xWD/NJb5iad6+hwNeG090V7lTRHVirvPFFg66tZH4F5qJELw0+QIzOvf210Ib1AWKHVh5P8cv7xu1TXZsFQWrUKPTAukSpDuGukbAIjttRNotnXnnRSq95BHZc1KZaeLnMW/wwoGrF4Dz0aqxntSln8lLHizXAzxm46Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787699923; c=relaxed/simple; bh=ErR1b5AtCHEKNxWDQFJ1mgI8Ms2qVRSv8VmnA1X6Vak=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MKoUYpKJJvxlVHjmltDVGLuIwz07Osgrfqd7eg1iqV//8beeuNk9pswfcTfhUjFe3X4QT8SucO0Kk18aGwxX4bZ7Q8KuhbRniiRnO44S0JWVRwxococxT5dJhIvjBbhAO3ux81vn7mEMGzuMAJW41t8NiKGKOHVLojW2Ig+5OOA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=eDJJYEUb; arc=none smtp.client-ip=209.85.128.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="eDJJYEUb" Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-4921eed3fa2so2738945e9.0 for ; Tue, 25 Aug 2026 16:18:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787699920; x=1788304720; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=GBczmDlPDOyOE71lusigm64t9wOw32FOsTpylbADhJ8=; b=eDJJYEUb9uCReQP5Fz9/8UYQSDSSW8SvMn+Jrrtrfv59ZSY2G+6B+QO5bN9GSDBu9w 6fVGU3et/EckxJwfa1Wz2we6Ew6CeF3iilpzQVnr09GydmrbAkPTmTX96ztNRvuNzYX3 PE834/JmO6ig5ll3HYYQo+afKiNb6SuwOmtUfZnGsM6A03nqbdQ/cLYVudwI+4R8fKxo /QCRexMYvkwzhGBws844jwNRd+3+Fwp2ZEujSLI/mJlSnYYPYLHWxeCmywdSG1+EmTcF 51XBNWA/dP4cTYMP6RUvg50DcEoP5GWBklJpXSQUG0Qf9ISqJ/CLAqnz+BhtjtT9yGzB M/5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787699920; x=1788304720; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=GBczmDlPDOyOE71lusigm64t9wOw32FOsTpylbADhJ8=; b=IF++9ywSRIACLsViUj0EhoBYr/oyX3BtTUx7VKIrqmlU7MGQY9SeXRSEuHDlYxafGo wv0qtLQJb0MHi/8+ap3KaV147CWFsKwNVNksFSrV+0IKKGHc5z705rzrPTKTpponv7bQ I58W8yl2pqQ5fjlrw8Zw5VpIfIJjci3BbxP9Mtw72sMiUiXF3WG75yrEl7vFM1p4Ijyl E/eqfUJUMSCTYiqv8eIz01FxawfgH74OmZkUgSysNL67goq/K3boSkOYlrrUWBW+5zH9 SXSiMnfRuLncfy31l8B8mC16N9dX/61YtpgWoXHTdDc5sPMGpdaWu7f0334vmO/qnyKR i58w== X-Forwarded-Encrypted: i=1; AHgh+RptLvLSphNfDn5VGBIlOUOPRtRs+8yyxhB4kqJOpsxuatLcfcm6ruzfMi4PXH1h1zQ+OwhZm7lzRv5XkPg=@vger.kernel.org X-Gm-Message-State: AFuF++meb5iNEeDwFUgR+3BoZQeiZB6831oVsLiVPnobbv7Mg694ZWEd cDMNy73oBPNVzRggtMzC22w4tAvCCLzFVtIhQKydtkMabTXO9tMkQsOU X-Gm-Gg: AR+sD10hlo1d2NUfA8ZPf0rXKh5fFmV7BdUHsUkceL49b3IAxBlCXr8LtO8QrbwU/ZA yq1Bgib5YpbcO0BNcGhxbFK0XfYTsHQxawQsQHJlBHVtHEyXWAanbUmucuoV2paQh6gXgLynDYp Hx17jPTr60KGoiEI6jdzw4kmarUcezsjXlaNyRXs0IgP/XFGWujph9I+C+c6KAiUWLQAyuI8tb3 SIDhtnoNAr6O/jIfjJ1WsiO4ffaR8UoNNdeC8CdfWyKjYViHGDmVk4MAnTBJGd6zsjtICshgZjE kz0BRC1IXzdOqZx/kMLWDSY+aY9A03MLEphuVS7NFVuFAtHvUwKBt2uHTyEilvqnsCRkt9uykNy INVHxb3DBtgoh1NvH+oi2mfW5hkyJ3Nw5R0XUUf309dzXMdlgxPa5ivjX9WqQ5SYHpWboQZqZve pXm9kXs4HixX4BsRuTpkJCUMXB6jjK27UpGJGoqP/DUXTuGCV46dFJN4xbgfoEec+HeWpaKJuTe L5BG0Zn9eCTOWCpz41HA/lnDIr9j1e/O2/APYPT4p5xHak6 X-Received: by 2002:a05:600c:c48e:b0:499:9240:9a1c with SMTP id 5b1f17b1804b1-499dc82ced5mr17382165e9.15.1787699920268; Tue, 25 Aug 2026 16:18:40 -0700 (PDT) Received: from dohko.chello.ie (188-141-5-72.dynamic.upc.ie. [188.141.5.72]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482e279e8b7sm864017f8f.7.2026.08.25.16.18.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 25 Aug 2026 16:18:38 -0700 (PDT) From: David Carlier To: Jeff Chen Cc: Francesco Dolcini , Johannes Berg , linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, David Carlier Subject: [PATCH wireless-next 1/2] wifi: nxpwifi: fix inverted check in Tx BA stream entry deletion Date: Wed, 26 Aug 2026 00:17:09 +0100 Message-ID: <20260825231834.244783-2-devnexen@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260825231834.244783-1-devnexen@gmail.com> References: <20260825231834.244783-1-devnexen@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" nxpwifi_is_tx_ba_stream_ptr_valid() returns true when the entry is still linked, and every caller passes an entry that is on the list, so the early return always fires and nothing is ever unlinked or freed. Entries leak on every teardown and, since nxpwifi_space_avail_for_new_ba_stream() counts them, Tx aggregation stops being negotiated once the stale count reaches the maximum. Changing the original dead && test to || to silence a NULL dereference report inverted the validity test along with it. Fixes: 00c786a7581e ("wifi: nxpwifi: fix multiple static analysis errors an= d warnings") Assisted-by: Claude:claude-opus-5 Signed-off-by: David Carlier --- drivers/net/wireless/nxp/nxpwifi/11n.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/nxp/nxpwifi/11n.c b/drivers/net/wireless/= nxp/nxpwifi/11n.c index c2a54d781b42..25b2e430f3f9 100644 --- a/drivers/net/wireless/nxp/nxpwifi/11n.c +++ b/drivers/net/wireless/nxp/nxpwifi/11n.c @@ -451,7 +451,7 @@ void nxpwifi_11n_delete_tx_ba_stream_tbl_entry(struct nxpwifi_private *priv, struct nxpwifi_tx_ba_stream_tbl *tbl) { - if (!tbl || nxpwifi_is_tx_ba_stream_ptr_valid(priv, tbl)) + if (!tbl || !nxpwifi_is_tx_ba_stream_ptr_valid(priv, tbl)) return; =20 nxpwifi_dbg(priv->adapter, INFO, --=20 2.55.0 From nobody Mon Sep 28 05:49:54 2026 Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4D0E3490C05 for ; Tue, 25 Aug 2026 23:18:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.47 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787699925; cv=none; b=aj37PyZspShuLcLucoZ8B+deIkRRfIUvq5WO47qk5dG5PZks7NECLVB3+EjNaZwJRYXHmPXr1wTLc126JNs12dn2HZKCn5Cf7hDPmM8h0e3yq84/nCGPVwlsQcoz/ClWSkCNoCHzDn/TEXkPVJLaSlsJLhBG78HxtmYIALIMPlg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787699925; c=relaxed/simple; bh=HXB4bVWiYtHeNKcVwR0OXbtBoIIb+b9e4Qe725FgQXA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=cxNu6yfVvGV17vIBUdX4F/FCM+dMjHRbrQlB42asHWrpG6hwOeSf/dGidmLS6osfL7Wqi3xPpYtFEJeKif7KH+SVYeZuethUdJOPji/toN73tu90MmsScJvOEMY/DIQ1jV0zfIZEYRPQkEEb80ED3Fw8i4VUuJNdj+UAB0G/9kE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=bnhn/Hze; arc=none smtp.client-ip=209.85.128.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="bnhn/Hze" Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4995b0343c1so2004825e9.3 for ; Tue, 25 Aug 2026 16:18:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787699922; x=1788304722; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=YHt6N3XaltucIJM+1NviMsc1T4gCEHtkC9VE85Ji+gA=; b=bnhn/Hze4weblyA0PwecxTBSLRrV1pLD/hGGbEFfOZ8lE8gu+f2nbGKiuTQRBfiyj0 Q8rwogik3TknvMuGrmc4sYsKVsnNNth84HaViYXqAMryaTcK2W0T87qpU1JYIbi0T+Ly Vvtid3LwzOOU4bEnUJxGInmqsI6fEjkuUCYiS07SzvpE8NUDjfHwIakKZ0aHjWQI3rLJ Uk1G/b6IDg2rYztArjD6h9qLzuC82SBJpjWorQbQS7hG2XYN13a9evXEB4KVplkXYIWV M7VHM8nuOqQpc/q7+p1AoNcz8cvZRyPVo1k/LXtqezaXE02sShX6Axcj9V2Hq5AmLfLe 4a8A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787699922; x=1788304722; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=YHt6N3XaltucIJM+1NviMsc1T4gCEHtkC9VE85Ji+gA=; b=mx4xvN6kGNB/noVQn1v9k1Nin/ntu6UG5ozz1yBNlN8A+JWin2/9DD2uullpbgw8Xy kcBAU/E7RGVKF0GQoGjrgLq/bDZYD+a1HgptrHE2HOScGPxuptOWHIaChyxs58Re80MM VL2NIuaTxsyrNUPqVCqv+tmtgTfQsAPMW5SOrMAYpZucxVoZJY54FuwMf+VOixrofGIZ 3BIulDZdjBSKcyGT1Tqp1gDvAXVRpC5WPPv2EByiy/XGfU8XKcuCr71WLPPFTYN/7WXj ZFGJ6Dvo0JiEthZhkFmMeasUdef5XTkzl8uHwszSnEJG27/XuLuS176/7+0vLe7HoIQL XbOw== X-Forwarded-Encrypted: i=1; AHgh+RoOXz0HJlXSoRhhD8jvUks83Numk6/DcAUmILNitsKTfmG74raoClyAdUbJ2AQy0ufFbaN3wUHGeU/J3QM=@vger.kernel.org X-Gm-Message-State: AFuF++l5PrcQStLxxHB4SyPqdSZdGEcqPCGqOUTd8hLlgLNTTvW9vTmp JOlLE50yaOwD3f/8vg7AtoDNQoGoeY7rh3duY+mlyt434iwFmnmK2NnJ X-Gm-Gg: AR+sD11R2ecXqrp4RGU7szXJFzSoH5SObmx65RIdrlp3O3mpSxYOEGUfNcDC0RtGsLQ a0oac/qdPPvZ1ZYQDMu9UeZ3AohNyNiKB++0vBwbUx3LX3PToWOImzZx7Esc28TjD/pRweuH8xQ 4rVSrWX69cmUKyA/KmhOgJCpt6SPiofJy1YrIddyJFcU3q7LnUJf4DjCqzrPAkdxrnHpxNdaO3J M4IKVMglzsQiE1tqhVd2wDG3/TWXbjuL953E09rL66bdUOPc87+IK5flrtuXAHSVTe0D5sW6A8v qygLqHHN4BAu6RV7nUsJ5Ag6pRZaQV3CpcNveJlGHLYFhSLLb0XEY+JKtcx/os/iNNP81LipT0i 9u5Xxvq144BHS6MzwAL5tVoTCedzv9XZbCUXIw0LdNmsgoJUf9yRM/9Pk+KTgtTSdnFix9zFhBv Z2vE9zYcEKdRQCjhaoKB8X6hJrICzCRIk0TnlQ+kD+NyR8CqVdSGSYJHcCeDcm+FFq1Y4LRz35v 2Uk+cw8wDbLSFv7phqMs04E6xifu2UjK1UO9i6dis0kFcgd5z/+m5z6jHM= X-Received: by 2002:a05:600c:3acf:b0:499:db5a:1049 with SMTP id 5b1f17b1804b1-499dc70246bmr21444865e9.8.1787699922559; Tue, 25 Aug 2026 16:18:42 -0700 (PDT) Received: from dohko.chello.ie (188-141-5-72.dynamic.upc.ie. [188.141.5.72]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482e279e8b7sm864017f8f.7.2026.08.25.16.18.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 25 Aug 2026 16:18:41 -0700 (PDT) From: David Carlier To: Jeff Chen Cc: Francesco Dolcini , Johannes Berg , linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, David Carlier Subject: [PATCH wireless-next 2/2] wifi: nxpwifi: do not delete Rx reorder entries under RCU Date: Wed, 26 Aug 2026 00:17:10 +0100 Message-ID: <20260825231834.244783-3-devnexen@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260825231834.244783-1-devnexen@gmail.com> References: <20260825231834.244783-1-devnexen@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The RCU guard is declared in the body of the per-TID loop, so it is still held across the teardown pass. nxpwifi_del_rx_reorder_entry() flushes the Rx workqueue and deletes the reorder timer synchronously, both of which sleep, so a station deauthenticating from the AP splats under CONFIG_DEBUG_ATOMIC_SLEEP. Scope the guard to the collection walk. The teardown does not need RCU: it serialises on priv->rx_reorder_tbl_lock[] and frees with kfree_rcu(). Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x") Assisted-by: Claude:claude-opus-5 Signed-off-by: David Carlier --- drivers/net/wireless/nxp/nxpwifi/11n_rxreorder.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/net/wireless/nxp/nxpwifi/11n_rxreorder.c b/drivers/net= /wireless/nxp/nxpwifi/11n_rxreorder.c index 65b628411543..87cf2ec85991 100644 --- a/drivers/net/wireless/nxp/nxpwifi/11n_rxreorder.c +++ b/drivers/net/wireless/nxp/nxpwifi/11n_rxreorder.c @@ -205,11 +205,12 @@ void nxpwifi_11n_del_rx_reorder_tbl_by_ta(struct nxpw= ifi_private *priv, u8 *ta) return; =20 for (i =3D 0; i < MAX_NUM_TID; i++) { - guard(rcu)(); - list_for_each_entry_rcu(tbl, &priv->rx_reorder_tbl_ptr[i], list) { - if (!memcmp(tbl->ta, ta, ETH_ALEN)) { - INIT_LIST_HEAD(&tbl->tmp_list); - list_add_tail(&tbl->tmp_list, &to_delete); + scoped_guard(rcu) { + list_for_each_entry_rcu(tbl, &priv->rx_reorder_tbl_ptr[i], list) { + if (!memcmp(tbl->ta, ta, ETH_ALEN)) { + INIT_LIST_HEAD(&tbl->tmp_list); + list_add_tail(&tbl->tmp_list, &to_delete); + } } } =20 --=20 2.55.0