The branch stable/14 has been updated by bz:
URL:
https://cgit.FreeBSD.org/src/commit/?id=65de0f1855f3e2e49413dfa03ffbfd6735d3e738
commit 65de0f1855f3e2e49413dfa03ffbfd6735d3e738
Author: Austin Shafer <asha...@badland.io>
AuthorDate: 2024-10-10 15:31:07 +0000
Commit: Bjoern A. Zeeb <b...@freebsd.org>
CommitDate: 2024-10-16 21:46:19 +0000
LinuxKPI: 802.11: fix ieee80211_schedule_txq() to avoid rtw89 panic
rtw89 TX path was faulting in linuxkpi_ieee80211_next_txq() due to a
"double scheduling" check in linuxkpI_ieee80211_schedule_txq() being
incorrect:
the next pointer may be NULL there if the element is the last in the
tailq, so correctly check tqe_prev. Without the fix we may have queued
the same element to the tailq twice, and because it was the last element
and had a NULL tqe_next, that NULL value would get propogated into
another node's tqe_prev on removal, and other such nastiness.
With this rtw89 no longer panics.
Reviewed by: bz
Differential Revision: https://reviews.freebsd.org/D47006
(cherry picked from commit 41b746e05231b44c87f3a3087a7fe29966af6d0f)
---
sys/compat/linuxkpi/common/src/linux_80211.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c
b/sys/compat/linuxkpi/common/src/linux_80211.c
index 56bc9252511a..ff257bf32766 100644
--- a/sys/compat/linuxkpi/common/src/linux_80211.c
+++ b/sys/compat/linuxkpi/common/src/linux_80211.c
@@ -6075,8 +6075,12 @@ void linuxkpi_ieee80211_schedule_txq(struct ieee80211_hw
*hw,
if (!withoutpkts && ltxq_empty)
goto out;
- /* Make sure we do not double-schedule. */
- if (ltxq->txq_entry.tqe_next != NULL)
+ /*
+ * Make sure we do not double-schedule. We do this by checking tqe_prev,
+ * the previous entry in our tailq. tqe_prev is always valid if this
entry
+ * is queued, tqe_next may be NULL if this is the only element in the
list.
+ */
+ if (ltxq->txq_entry.tqe_prev != NULL)
goto out;
lhw = HW_TO_LHW(hw);
