From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D2510349CD6 for ; Sat, 27 Jun 2026 21:24:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.177 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782595464; cv=none; b=R5ns76jkM5nTD6hHIUz/+naVGFUGzn1bjoj2JcTQDHuUwmRcJ7AAssWg5vWTUAk4l8xRjz1329KE6k0zgWlUwp8A5M7g7EULzBfq/8zIhNbZx+ciHRaP2PnG1K3llx6Mvll3p/H8Dn1XbHNW6/Tyu8tCsT+V7mwyQrT+prPBZP0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782595464; c=relaxed/simple; bh=IUyoAwh6Lj6kLlHT6+22O+dIusg/oxs3tvggN0o137o=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=gjnY8Hb1ZckE4C9JKaQO4YyC8vw1ICwF1wy57ZP9fI8kNrcV+2A/t4z+vxN4rWNnurzTJaoKnIY15UN9cM08fx0O7ecGN10S8nfm/R8hu31gA0UJayy4jLdUvzpOIh/lwC2v9UXpW+jCS221Kn9zcHs7M+5SrBp0ZXvOCwELXxY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=AweJms17; arc=none smtp.client-ip=209.85.214.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="AweJms17" Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-2c9b1edf2bdso3703215ad.1 for ; Sat, 27 Jun 2026 14:24:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782595461; x=1783200261; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=igs8wchjNfL4A9LCwiFhYRNoXyP6j1PwR4BSWRj01Xo=; b=AweJms17w8pBg2w0PoglWG450jNzq+e2J21JVgWQyLLx/X4OBgM7jH24wQS5uTmZP7 7QkN4FfHNobhXdYoTGHJmDsau5Zds5H/BqFL6XUhCed1xg1rEQ+B3cF0Frd8xTBSsNzP MxAFC8Nt+hemxlvCs42zqznIPwXgTgc3g4vAXnEnYHJQYXXkrRarVNfI84kPadpfWcBo EE4WueJprkj2dXAbUKROv/67pOY4KgfBBw7fuG2BYGL0UJUK8maflt1UiDzi5wI9cEFy TFDdyQl7BB9g54hIhV9KVpdDaPK+jgh/47dn3Sr9OYizMfwDbmtj2PIYaJAtoH9KiCfM 4idg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782595461; x=1783200261; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=igs8wchjNfL4A9LCwiFhYRNoXyP6j1PwR4BSWRj01Xo=; b=X//AuSWw0BGN9jkDKtDs1IUg5KlW6cRXadtsl+l84pO7IcwREhkJ9tJIxjeXh8yrAb 1PoJiwLS2kVcBEaG3jF8Ozn3BkVJR/ZB24YLKTo9rTRWhiu+Pg2u4n0bH2dAVJX8RYRX ZXLT9QnfuYbSKl01N5cH9zcLGtpdUhQnUiUdABpSnYdrPdnH+9uQuPgNBAwOIw51twy3 WKwmbK98dg8n+EA+LDU5C5BgFaSRVoJ4SxQocBp04BL+vRD2a6o+dIxswdQsg54HGO5K WKdHWZ4bjXTGrbXLoD8pgFTYIe2X92eTUJ8YxSJF0lG8DimqkzoRDOTZq3NKBF0Rf/8f +pGQ== X-Forwarded-Encrypted: i=1; AHgh+RpZgy7Mg62BXy/iulU8Nfy01PDaVst4I4yJtlKcx6rwUiOOzrFUF0LcjdyVzeDwNisH4yBYaplDaB9rlfU=@vger.kernel.org X-Gm-Message-State: AOJu0Yx4DK+lOngGFl+F9HrWVBQaLHIS5lsyAZQmA9c4O/uAIWOWb/Bi jv1cvdpP089/Z6tzdkUQQQsoeN5GAYMajD6qAruf9ar2reY2ftV6+oxSm5etmA== X-Gm-Gg: AfdE7cl6FG6AnDJxHhx3KT6CdZ6co4pfHS5F4HopFp2MGGl2dk5UYHQGR0Blz6KheA6 sF5dj50idk18AhMGFNeLEHiYVGbeH4y2y1UX333dq1z2ysSB/iicm5rwVTONvZU/19csb2IC0pb OzMuQxmCGqdUFdjxSuD1ZsKaVchctGweokhSdhBvilP9aPmaWmxLovHrg0BAEsNxLqw567DrAGi w5O0RlNZJFw8JJQa/Zj0oqOgFHeCtLFN3i0uIRbck3+mlWnj9HKfOcRGGqxRAL9AkL+KCkSXZ1j 0f4wroeAKaQ86KEtcJ3B6au7LTLvG4zgfH90RcrVNLWptphWp6hZ4PzLoYksF2M/WIpIdbpt57a 95sBsXWOtGToQ37WWDLrVjoKDNCKeaGUAxaepAFDs2cIFg/elrlmgQLUgldf5QPLpULo/NnAQIY /sjHsq+a9W4vCmEj0wGmri0xjjdhygRqKsm0b08mR0CrQPh/ntz9JbrEpoRe9zVFdWeSXg2RcEM 4LinVKRbw== X-Received: by 2002:a17:903:1b4b:b0:2bf:9760:b94d with SMTP id d9443c01a7336-2c9854c82dbmr46250585ad.15.1782595460956; Sat, 27 Jun 2026 14:24:20 -0700 (PDT) Received: from ryzen.lan ([2601:644:8000:7a86::e34]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c7f5ac8988sm63753185ad.15.2026.06.27.14.24.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 27 Jun 2026 14:24:20 -0700 (PDT) From: Rosen Penev To: linux-wireless@vger.kernel.org Cc: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= , linux-kernel@vger.kernel.org (open list) Subject: [PATCHv3 ath-next] wifi: ath9k: fix stale list pointers on A-MPDU subframe retry Date: Sat, 27 Jun 2026 14:24:17 -0700 Message-ID: <20260627212417.448046-1-rosenp@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit In ath_tx_complete_aggr(), subframes that need retransmission are moved to the local bf_head list via list_move_tail() For retry frames (txpending), the skb is requeued to bf_pending, but bf_head goes out of scope at the end of the loop iteration, leaving bf->list pointing to freed stack memory. On retry, the buffer is recovered via fi->bf in ath_tx_get_tid_subframe(), and list_add_tail() in ath_tx_form_aggr() overwrites the stale pointers harmlessly, so there is no leak, but the stale pointer is technically a use-after-scope bug. Fix by calling list_del_init() to cleanly remove the buffer from the dead bf_head and reinitialize its list pointers before the iteration ends. Do not unmap DMA, do not clear fi->bf, and do not return the buffer to the pool - the buffer is needed on retry with the original sequence number to keep the Block Ack window consistent. Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev --- v3: simplify to just delete. No need for handling others. v2: set fi-bf to NULL. drivers/net/wireless/ath/ath9k/xmit.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c index 7e134dd8b8c8..adb3af1b43d4 100644 --- a/drivers/net/wireless/ath/ath9k/xmit.c +++ b/drivers/net/wireless/ath/ath9k/xmit.c @@ -667,6 +667,9 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq, * queue to retain ordering */ __skb_queue_tail(&bf_pending, skb); + + if (!list_empty(&bf_head)) + list_del_init(&bf->list); } bf = bf_next; -- 2.54.0