linux-kernel - [PATCH rtw-next 6/6] wifi: rtw89: forcefully clear TX wait list on HCI reset

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250920132614.277719-7-pchelkin@ispras.ru>
Date: Sat, 20 Sep 2025 16:26:11 +0300
From: Fedor Pchelkin <pchelkin@...ras.ru>
To: Ping-Ke Shih <pkshih@...ltek.com>,
	Bitterblue Smith <rtl8821cerfe2@...il.com>
Cc: Fedor Pchelkin <pchelkin@...ras.ru>,
	Zong-Zhe Yang <kevin_yang@...ltek.com>,
	Po-Hao Huang <phhuang@...ltek.com>,
	linux-wireless@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	lvc-project@...uxtesting.org
Subject: [PATCH rtw-next 6/6] wifi: rtw89: forcefully clear TX wait list on HCI reset

TX status reporting based on firmware messages does not necessarily happen
when an HCI reset occurs, in contrast to RPP based one where pending skbs
are forcefully flushed, see rtw89_pci_release_txwd_skb().

So for the former case, if completion from the firmware doesn't happen, TX
wait objects are wastefully piled up in the list and not released.
Forcefully clear TX wait list on HCI reset then.

It's okay since wiphy lock is held during HCI reset.  For the RPP case,
all pending completions were done just before in ->reset callback and no
new ones can appear.  For the C2H message case, RCU access to the list
helps.

Found by Linux Verification Center (linuxtesting.org).

Signed-off-by: Fedor Pchelkin <pchelkin@...ras.ru>
---
 drivers/net/wireless/realtek/rtw89/core.c | 2 +-
 drivers/net/wireless/realtek/rtw89/core.h | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
index e76f04736502..3a0388d3acbf 100644
--- a/drivers/net/wireless/realtek/rtw89/core.c
+++ b/drivers/net/wireless/realtek/rtw89/core.c
@@ -1140,7 +1140,7 @@ static void rtw89_tx_wait_work(struct wiphy *wiphy, struct wiphy_work *work)
 	struct rtw89_dev *rtwdev = container_of(work, struct rtw89_dev,
 						tx_wait_work.work);
 
-	rtw89_tx_wait_list_clear(rtwdev);
+	rtw89_tx_wait_list_clear(rtwdev, false);
 }
 
 void rtw89_core_tx_kick_off(struct rtw89_dev *rtwdev, u8 qsel)
diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h
index e7948bd0bdf6..0ad871472e79 100644
--- a/drivers/net/wireless/realtek/rtw89/core.h
+++ b/drivers/net/wireless/realtek/rtw89/core.h
@@ -6282,14 +6282,14 @@ static inline void rtw89_tx_wait_release(struct rtw89_tx_wait_info *wait)
 	kfree_rcu(wait, rcu_head);
 }
 
-static inline void rtw89_tx_wait_list_clear(struct rtw89_dev *rtwdev)
+static inline void rtw89_tx_wait_list_clear(struct rtw89_dev *rtwdev, bool force)
 {
 	struct rtw89_tx_wait_info *wait, *tmp;
 
 	lockdep_assert_wiphy(rtwdev->hw->wiphy);
 
 	list_for_each_entry_safe(wait, tmp, &rtwdev->tx_waits, list) {
-		if (!completion_done(&wait->completion))
+		if (!force && !completion_done(&wait->completion))
 			continue;
 		list_del_rcu(&wait->list);
 		rtw89_tx_wait_release(wait);
@@ -6305,7 +6305,7 @@ static inline int rtw89_hci_tx_write(struct rtw89_dev *rtwdev,
 static inline void rtw89_hci_reset(struct rtw89_dev *rtwdev)
 {
 	rtwdev->hci.ops->reset(rtwdev);
-	rtw89_tx_wait_list_clear(rtwdev);
+	rtw89_tx_wait_list_clear(rtwdev, true);
 	skb_queue_purge(&rtwdev->tx_rpt_queue);
 }
 
-- 
2.51.0