From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4701C40855 for ; Thu, 14 May 2026 08:15:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778746536; cv=none; b=X9DTTBKhmj/vtNjNzkLjFiZMGf2BMsWxVpt9Y28JT+g6uhrtgcIiWx1JX0BwCdzVxFrAo088LQ2FGGqjLT8S679yLcDJwjD5MlEl7aBvv+e29+cEPJYSqubcIxA1DigPNiNAPnKZ6ac3rU9C0qaFRdnwbDwMmIwR5eHPCK9pfSQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778746536; c=relaxed/simple; bh=zEEkY2jSKxlfR3UMEU+YviVlz8guzzmOR/Pxg3hB5eU=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=hnaL6Lx3zEtGtYd7EhviDEcsZVzgHRrAZxOtqrrgPJR/TWKqVArH0zcI2saCEf0emJTfowm+IGCBhfLesk3NAWLmuIHwHmLeku5kUO3ELsMuQTfeoJCqdzRV/Z30qdjW3Yq2C3Th8T7RetB5OgL8quQdCYuYDHjhE9FsHsXvB/Q= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=oY5nvkQ6; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=T4TE7Z76; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="oY5nvkQ6"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="T4TE7Z76" Received: from pps.filterd (m0279865.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 64E4gilk3014308 for ; Thu, 14 May 2026 08:15:34 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= 2DQezXlwgxWUm8Dw+7AH5kOEuiqxY5oqs/GcaOSPTjw=; b=oY5nvkQ61UO6cd76 a9nx/IFmAUAz+p9ecYcZD4lFCrftdX/zxXk8k1YZLMyqg+ZG1wSlVHgfDHOCmwin J+0ajIbPoC88+G3jJFbvwZN1N24+JErWJoTLM4CQ7mvtFl1vEoABE3/HmYdtZpcp gQ1/JH/vr2mKOz8WquChf3bGbo+7h88lNJZq2Jf/tIB+jVxINgUJnm1x4U6e6cDt l0N0ZY3q+kqUMvlG4U1/lCbnhbhTrGBcvEzs+haTtLHwmQvcBOI8EbA2oRmSLUjP tC++sDO1LtWv53L8+QZHxfxviolES6zgQLhb0CHs87/Bn2cnK4/gHDOuBLFdcZ55 83NpDw== Received: from mail-pj1-f72.google.com (mail-pj1-f72.google.com [209.85.216.72]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4e57ksrnc1-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 14 May 2026 08:15:34 +0000 (GMT) Received: by mail-pj1-f72.google.com with SMTP id 98e67ed59e1d1-36603ad6709so8187898a91.2 for ; Thu, 14 May 2026 01:15:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1778746534; x=1779351334; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:content-language:from :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=2DQezXlwgxWUm8Dw+7AH5kOEuiqxY5oqs/GcaOSPTjw=; b=T4TE7Z76L/QwnehmhRsvuSW8/J1KhpmhO//jKVwisJT6XqWdYFVe6LSgs9sbGfjZaY GJ/Ta0MQh4vJHHWbtddqS/V067AOybl3aB43V9lNOdJPZmm57141diLlbo9YDiuKLqjl ZGCPV3aXNJWULgJM2FhgnVKMa/YuwH+g1RweVMdydpYosaA6sObDwfably5MvTq+Eaxd 4Tlcu5ZPMRUffLRibDrZKg9VpNfI6jELhf9qLLVVELhHgkwpIvH2T9+Y5proDTX242LU OOIfkqaSRt6xiBSNx6BKkV5RG9NND81Z4P1YYp6A9ezwsq16xhexa54sLh/s8uSQ29tL KTew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778746534; x=1779351334; h=content-transfer-encoding:in-reply-to:content-language:from :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=2DQezXlwgxWUm8Dw+7AH5kOEuiqxY5oqs/GcaOSPTjw=; b=ifBG1wRNXMVKNgf6kNW07WDHQjK6fvEcY5jE5W4TYuFcoKVXR4tYfvOsO6oJtFpHp/ oecMC24uTP5y7MulbmtbihBVM3sSkWFoSpVNIl72akVDXUp/NRfXQYJKtqIX3JEzGFKF w2Mn/m6R7kTO82m6mMaX4v4hQh5TZkhB7/DUAHPLXIlohzN7e8CpceH3X647XlsGa2SG HmLME6ka3rJ8KR54EEHvkWaCzk8/kaL3kHr7GnqsRlZkunx6kClrX6jqa8d3rKo3JWV9 37DNdUkCDQjnb0IeiKjh/nQOXdXKcESzWYNjHyYLJybwZKhLE7PRdNGX0Spj3ds33Jdz TnUQ== X-Forwarded-Encrypted: i=1; AFNElJ/9QJbXT2e7K1VI5ClG6tltUXwk8JKvlUS14bRPP4rV30KtLQ2UqHEBPOZqOHAysItdT5cqtt89wyYzZZc=@vger.kernel.org X-Gm-Message-State: AOJu0YyC2J0oq8SZLMBrvu+y8X+/yoGheguik647HCvY9qQNP0RWLEi5 8SpBwDV/sQ4cBCpqC4ls4naCOiG7Djrw1s/5J5NskfIoQ7vkUZyxbm2q2GUZevDSd6PtCXGYAlc VD7FqVFe+/xHXSPo6+mSzhmWu3aiSxQ2KamHiRM+FCEJamLKIDvmZm6isobV8hYMrz6U= X-Gm-Gg: Acq92OHo80b/5jyUMVlHMZDMH5RM8oeMlzaZYTD339dYt/ouB1tdzywzeH6gy8E4KT2 tBc7qq8ZYa2Ga8+3BcVRCfSbdnt3hUChwgUKHP+/uA1VBP51Ut/i2egVy7aojr8yZLzSL9PV6nV +rA+IjAuJEzyMIvVexPIFkV7tyCFja8GFV6dC0hnnPHxFdqqP/Lfup+NaFU4JY+nlJEEu6WfglZ Z5dO6F17grpYbby80IM42LTKha7TsXfrVCps94rKAcY7imTTSvdz/UWSkpcyZWTOPD4LDDS/uq9 /xq0DB7rkrXKYgmHZjx3DWr9ebzdvXSs4XdBl+xAOA0qa2tkpcDrocAIMxNiZQTGFnM2R5Bevit QcbSOUYMKjg9xg6NcS2agdrnxBPfEfblh0Gam04UzC3jmUpPABM5dwylswQGMt9IsOzRuvfs6ec AsDdch1xy/LK8FMCZ9drM= X-Received: by 2002:a17:90b:3c0e:b0:366:4f8a:9847 with SMTP id 98e67ed59e1d1-368f3e681bemr6821455a91.17.1778746533473; Thu, 14 May 2026 01:15:33 -0700 (PDT) X-Received: by 2002:a17:90b:3c0e:b0:366:4f8a:9847 with SMTP id 98e67ed59e1d1-368f3e681bemr6821390a91.17.1778746532608; Thu, 14 May 2026 01:15:32 -0700 (PDT) Received: from [10.133.33.178] (tpe-colo-wan-fw-bordernet.qualcomm.com. [103.229.16.4]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c82bb100706sm1613791a12.17.2026.05.14.01.15.29 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 14 May 2026 01:15:32 -0700 (PDT) Message-ID: Date: Thu, 14 May 2026 16:15:27 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] wifi: ath11k: fix warning when unbinding To: Rameshkumar Sundaram , Jose Ignacio Tornos Martinez Cc: ath11k@lists.infradead.org, jjohnson@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, stable@vger.kernel.org References: <20260507070808.367442-1-jtornosm@redhat.com> <20260514061841.9517-1-jtornosm@redhat.com> <95bff017-3554-425f-ad8e-767f9cbe1277@oss.qualcomm.com> From: Baochen Qiang Content-Language: en-US In-Reply-To: <95bff017-3554-425f-ad8e-767f9cbe1277@oss.qualcomm.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Proofpoint-GUID: HYUZfDqtdjL9ner4ObXJkivByXMoaLB0 X-Authority-Analysis: v=2.4 cv=KZbidwYD c=1 sm=1 tr=0 ts=6a0584a6 cx=c_pps a=RP+M6JBNLl+fLTcSJhASfg==:117 a=nuhDOHQX5FNHPW3J6Bj6AA==:17 a=IkcTkHD0fZMA:10 a=NGcC8JguVDcA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=Um2Pa8k9VHT-vaBCBUpS:22 a=kMbTGvAQcfItPFarCmoA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=iS9zxrgQBfv6-_F4QbHw:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNTE0MDA4MCBTYWx0ZWRfX0Du/l13GVtyG qO9rFcAbRyY1jo2tA1K6n/G2Hfm4LhFXR/4mDdGpdjLKB5xm8RnvBF0wg6Nj+qb/72TNgNRJJbY 077P1Dj+XTXLN75bBw8flfVCShsQNxDzDX5O+oq3nOadl/NfBBVe/ePxJtWx5LaHkSohZyu7Fo9 9ZcBN3Kjq1QwcBxwIgc35XTzCqE7kZlr0Oxwl7BI7W3NtfCbHLtOOt4AbcrhqmA5qFIn65qJJG3 P6GRhCo6JheNmtoQlloCle0CZ5avQFJBtcFq80tG/yT83SnsXy2ICJH+TUKs+TFhp4qBgB2ZQmA D4I0Z8CYnFBYfCMD+Xq0JSYhh9uRoYfnjkBjOt+ochEa0OFZz/fnL4aw/c0H9g3lAUssBAzIlu1 oKlNO5M06nyodq8m2IveMl+7MsAmWIllaiZ1O5vFsPL2LokT8u6POB0TtAEyrRzX7Gjnd25foCK QAhak3EInLcoX/0HRlA== X-Proofpoint-ORIG-GUID: HYUZfDqtdjL9ner4ObXJkivByXMoaLB0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-05-14_01,2026-05-13_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 bulkscore=0 impostorscore=0 phishscore=0 lowpriorityscore=0 priorityscore=1501 adultscore=0 malwarescore=0 spamscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2605050000 definitions=main-2605140080 On 5/14/2026 2:55 PM, Rameshkumar Sundaram wrote: > On 5/14/2026 11:48 AM, Jose Ignacio Tornos Martinez wrote: >> Hello Rameshkumar, >> >>> I agree that setting tx_status to NULL makes ath11k_dp_free() more >>> defensive, and it matches the ath12k fix. >> Ok, I agree too. >> >>> However, i am still wondering how the second ath11k_dp_free() is reached >>> if ATH11K_FLAG_QMI_FAIL is set. >>> >>> In ath11k_pci_remove(), when ATH11K_FLAG_QMI_FAIL is set, we take the >>> qmi_fail path and skip ath11k_core_deinit(). So the normal remove path: >>> >>>      ath11k_pci_remove() >>>        ath11k_core_deinit() >>>          ath11k_core_soc_destroy() >>>            ath11k_dp_free() >>> >>> should not run. >>> >>> So if the double free is still reproducible with QMI_FAIL set (with the >>> change i proposed), either the flag is not actually set in this failure >>> case, or there is another path calling ath11k_dp_free() ? >> Let me try to clarify the issue more. >> There are two error actions: >> - First the previous error. I reproduce the situation as I commented: running >> in a VM the default upstream kernel (with this card using PCI passthrough), >> since this is always failing. Let me show the logs in this situation: >> [   15.906564] ath11k_pci 0000:07:00.0: BAR 0 [mem 0xfdc00000-0xfddfffff 64bit]: assigned >> [   15.926520] ath11k_pci 0000:07:00.0: MSI vectors: 32 >> [   15.928572] ath11k_pci 0000:07:00.0: wcn6855 hw2.0 >> [   16.984192] ath11k_pci 0000:07:00.0: chip_id 0x2 chip_family 0xb board_id 0xff soc_id >> 0x400c0200 >> [   16.984351] ath11k_pci 0000:07:00.0: fw_version 0x11088c35 fw_build_timestamp >> 2024-04-17 08:34 fw_build_id WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41 >> [   18.186971] ath11k_pci 0000:07:00.0: failed to receive control response completion, >> polling.. >> [   19.211036] ath11k_pci 0000:07:00.0: Service connect timeout >> [   19.211815] ath11k_pci 0000:07:00.0: failed to connect to HTT: -110 >> [   19.214181] ath11k_pci 0000:07:00.0: failed to start core: -110 >> [   19.531989] ath11k_pci 0000:07:00.0: firmware crashed: MHI_CB_EE_RDDM >> [   19.532930] ath11k_pci 0000:07:00.0: ignore reset dev flags 0xc000 >> [   29.259157] ath11k_pci 0000:07:00.0: failed to wait wlan mode request (mode 4): -110 >> [   29.259229] ath11k_pci 0000:07:00.0: qmi failed to send wlan mode off: -110 >> - Second after this, I commanded the unbinded (ath11_pci) and I get the >> warning. Let extend here the stack trace: >> [   24.238198]  ? free_large_kmalloc+0x57/0x90 >> [   24.238199]  ? report_bug+0x16b/0x180 >> [   24.238210]  ? handle_bug+0x3c/0x70 >> [   24.238218]  ? exc_invalid_op+0x14/0x70 >> [   24.238218]  ? asm_exc_invalid_op+0x16/0x20 >> [   24.238224]  ? free_large_kmalloc+0x57/0x90 >> [   24.238227]  ath11k_dp_free+0x99/0xb0 [ath11k] >> [   24.238275]  ath11k_core_deinit+0x12b/0x1a0 [ath11k] >> [   24.238287]  ath11k_pci_remove+0x7b/0x120 [ath11k_pci] >> [   24.238294]  pci_device_remove+0x3e/0xb0 >> [   24.238304]  device_release_driver_internal+0x193/0x200 >> [   24.238315]  unbind_store+0x9d/0xb0 >> [   24.238320]  kernfs_fop_write_iter+0x13a/0x1d0 >> [   24.238330]  vfs_write+0x32e/0x470 >> [   24.238335]  ksys_write+0x5f/0xe0 >> [   24.238336]  do_syscall_64+0x5f/0xe0 >> Very easy to reproduce. >> > > > Thanks much for the logs, that makes sense. The timestamps explain why my earlier > reasoning did not match the trace: unbind reaches ath11k_pci_remove() before > ATH11K_FLAG_QMI_FAIL is set by the QMI event worker as it is held up on wlan mode off qmi how could QMI worker set this flag? the first failure happens in ath12k_core_qmi_firmware_ready() and upon this failure the QMI worker just break out without setting any flag, no? > transaction, so remove still takes the normal ath11k_core_deinit() path. > > > -- > Ramesh >