From 519b527a9b83fd072e74611176b08170709e4001 Mon Sep 17 00:00:00 2001 From: Miri Korenblit Date: Wed, 15 Jul 2026 20:19:33 +0300 Subject: [PATCH] wifi: iwlwifi: trans: don't memset trans::conf when it is still needed Organization: Intel Israel (74) Limited Currently, trans::conf is cleared in opmode_leave(), which means that in the rest of the remove() it will be zeroed. But some of the freeing code still needs some data from it, for example the cmd_queue id. For older devices that their cmd_queue id is not 0, it can cause us to free queue 0 as it was a command queue. A command queue is different from a regular queue, the first has its cmd as regular kmalloc'ed memory while a regular queue has it from a kmem_cache, so the two should be freed differently. To avoid that, clear the trans::conf before we call the opmode instead. Signed-off-by: Miri Korenblit --- drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 2 ++ drivers/net/wireless/intel/iwlwifi/iwl-trans.c | 1 - 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c index 607fcea6f4ef..41fc45daa726 100644 --- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c +++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c @@ -1549,6 +1549,8 @@ _iwl_op_mode_start(struct iwl_drv *drv, struct iwlwifi_opmode_table *op) dbgfs_dir = drv->dbgfs_op_mode; #endif + memset(&drv->trans->conf, 0, sizeof(drv->trans->conf)); + op_mode = ops->start(drv->trans, drv->trans->cfg, &drv->fw, dbgfs_dir); diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.c b/drivers/net/wireless/intel/iwlwifi/iwl-trans.c index 5232f66c2d52..b25d54cfcfb7 100644 --- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.c +++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.c @@ -423,7 +423,6 @@ void iwl_trans_op_mode_leave(struct iwl_trans *trans) cancel_delayed_work_sync(&trans->restart.wk); trans->op_mode = NULL; - memset(&trans->conf, 0, sizeof(trans->conf)); trans->state = IWL_TRANS_NO_FW; } -- 2.34.1