linux-kernel - RE: [PATCH] Revert "wifi: iwlwifi: trans: remove STATUS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <DM3PPF63A6024A93B1437A144E82CC38B7AA393A@DM3PPF63A6024A9.namprd11.prod.outlook.com>
Date: Mon, 26 Jan 2026 07:15:54 +0000
From: "Korenblit, Miriam Rachel" <miriam.rachel.korenblit@...el.com>
To: Chris Bainbridge <chris.bainbridge@...il.com>, "kvalo@...nel.org"
	<kvalo@...nel.org>
CC: "Berg, Johannes" <johannes.berg@...el.com>, "benjamin@...solutions.net"
	<benjamin@...solutions.net>, "gustavoars@...nel.org" <gustavoars@...nel.org>,
	"linux-intel-wifi@...el.com" <linux-intel-wifi@...el.com>,
	"linux-wireless@...r.kernel.org" <linux-wireless@...r.kernel.org>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"stable@...r.kernel.org" <stable@...r.kernel.org>
Subject: RE: [PATCH] Revert "wifi: iwlwifi: trans: remove STATUS_SUSPENDED"


> -----Original Message-----
> From: Chris Bainbridge <chris.bainbridge@...il.com>
> Sent: Monday, January 26, 2026 1:34 AM
> To: Korenblit, Miriam Rachel <miriam.rachel.korenblit@...el.com>;
> kvalo@...nel.org
> Cc: Berg, Johannes <johannes.berg@...el.com>; benjamin@...solutions.net;
> gustavoars@...nel.org; linux-intel-wifi@...el.com; linux-
> wireless@...r.kernel.org; netdev@...r.kernel.org; linux-
> kernel@...r.kernel.org; Chris Bainbridge <chris.bainbridge@...il.com>;
> stable@...r.kernel.org
> Subject: [PATCH] Revert "wifi: iwlwifi: trans: remove STATUS_SUSPENDED"
> 
> This reverts commit e769f6f27ffe41331e00b69a33aa8a34db4dd830.
> 
> The removal of STATUS_SUSPENDED (which tracks suspend/resume state)
> resulted in an intermittent race condition on resume. The fault can be
> reproduced by carrying out repeated suspend/resume cycles while passing
> traffic through the NIC. A typical failure looks like:
> 
> [  141.093986] iwlwifi 0000:01:00.0: Error sending SCAN_CFG_CMD: time out
> after 2000ms.
> [  141.094057] iwlwifi 0000:01:00.0: Current CMD queue read_ptr 441
> write_ptr 442 [  141.094864] iwlwifi 0000:01:00.0: Start IWL Error Log Dump:
> [  141.094866] iwlwifi 0000:01:00.0: Transport status: 0x00000042, valid: 6 [
> 141.094870] iwlwifi 0000:01:00.0: Loaded firmware version: 89.7f71c7f4.0 ty-
> a0-gf-a0-89.ucode [  141.094873] iwlwifi 0000:01:00.0: 0x01000071 |
> ADVANCED_SYSASSERT ...
> [  141.098401] iwlwifi 0000:01:00.0: iwl_mvm_check_rt_status failed, device is
> gone during suspend
> 
> The kernel then oops due to a null pointer dereference in
> iwl_mvm_realloc_queues_after_restart().
> 
> Fixes: e769f6f27ffe ("wifi: iwlwifi: trans: remove STATUS_SUSPENDED")
> Closes: https://yhbt.net/lore/linux-
> wireless/aTDoDiD55qlUZ0pn@...ian.local/
> Cc: <stable@...r.kernel.org>
> Signed-off-by: Chris Bainbridge <chris.bainbridge@...il.com>
> ---
>  .../net/wireless/intel/iwlwifi/iwl-trans.c    | 22 +++++++++++++++++--
>  .../net/wireless/intel/iwlwifi/iwl-trans.h    |  3 +++
>  2 files changed, 23 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.c
> b/drivers/net/wireless/intel/iwlwifi/iwl-trans.c
> index cc8a84018f70..f5c4aa165c5b 100644
> --- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.c
> +++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.c
> @@ -306,6 +306,9 @@ int iwl_trans_send_cmd(struct iwl_trans *trans, struct
> iwl_host_cmd *cmd)
>  		     test_bit(STATUS_RFKILL_OPMODE, &trans->status)))
>  		return -ERFKILL;
> 
> +	if (unlikely(test_bit(STATUS_SUSPENDED, &trans->status)))
> +		return -EHOSTDOWN;
> +
>  	if (unlikely(test_bit(STATUS_FW_ERROR, &trans->status)))
>  		return -EIO;
> 
> @@ -406,6 +409,8 @@ int iwl_trans_start_hw(struct iwl_trans *trans)
>  	might_sleep();
> 
>  	clear_bit(STATUS_TRANS_RESET_IN_PROGRESS, &trans->status);
> +	/* opmode may not resume if it detects errors */
> +	clear_bit(STATUS_SUSPENDED, &trans->status);
> 
>  	return iwl_trans_pcie_start_hw(trans);  } @@ -505,17 +510,30 @@
> iwl_trans_dump_data(struct iwl_trans *trans, u32 dump_mask,
> 
>  int iwl_trans_d3_suspend(struct iwl_trans *trans, bool reset)  {
> +	int err;
> +
>  	might_sleep();
> 
> -	return iwl_trans_pcie_d3_suspend(trans, reset);
> +	err = iwl_trans_pcie_d3_suspend(trans, reset);
> +
> +	if (!err)
> +		set_bit(STATUS_SUSPENDED, &trans->status);
> +
> +	return err;
>  }
>  IWL_EXPORT_SYMBOL(iwl_trans_d3_suspend);
> 
>  int iwl_trans_d3_resume(struct iwl_trans *trans, bool reset)  {
> +	int err;
> +
>  	might_sleep();
> 
> -	return iwl_trans_pcie_d3_resume(trans, reset);
> +	err = iwl_trans_pcie_d3_resume(trans, reset);
> +
> +	clear_bit(STATUS_SUSPENDED, &trans->status);
> +
> +	return err;
>  }
>  IWL_EXPORT_SYMBOL(iwl_trans_d3_resume);
> 
> diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
> b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
> index a552669db6e2..c4d06a323f9b 100644
> --- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
> +++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
> @@ -290,6 +290,8 @@ static inline void iwl_free_rxb(struct
> iwl_rx_cmd_buffer *r)
>   *	the firmware state yet
>   * @STATUS_TRANS_RESET_IN_PROGRESS: reset is still in progress, don't
>   *	attempt another reset yet
> + * @STATUS_SUSPENDED: device is suspended, don't send commands that
> + *	aren't marked accordingly
>   */
>  enum iwl_trans_status {
>  	STATUS_SYNC_HCMD_ACTIVE,
> @@ -303,6 +305,7 @@ enum iwl_trans_status {
>  	STATUS_IN_SW_RESET,
>  	STATUS_RESET_PENDING,
>  	STATUS_TRANS_RESET_IN_PROGRESS,
> +	STATUS_SUSPENDED,
>  };
> 
>  static inline int
> --
> 2.47.3

Hi Chris, could you please provide the full log?

Miri