Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   gregory.greenman@intel.com
To:     johannes@sipsolutions.net
Cc:     linux-wireless@vger.kernel.org,
        Miri Korenblit <miriam.rachel.korenblit@intel.com>,
        Gregory Greenman <gregory.greenman@intel.com>
Subject: [PATCH 12/31] wifi: iwlwifi: mvm: fix crash on queue removal for MLD API too
Date:   Tue, 28 Mar 2023 10:58:52 +0300
Message-Id: <20230328104948.527dace26147.Ia215df5833634f95688a979f39fae70c1ac4e027@changeid>
In-Reply-To: <20230328075911.2370108-1-gregory.greenman@intel.com>
References: <20230328075911.2370108-1-gregory.greenman@intel.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

From: Miri Korenblit <miriam.rachel.korenblit@intel.com>

The patch linked below fixes the crash on queue removal bug only
for the non-MLD API. Do the same for the MLD API.

Fixes: c5a976cf6a75 ("wifi: iwlwifi: modify new queue allocation command")
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
---
 .../net/wireless/intel/iwlwifi/mvm/mld-sta.c   | 18 +++++-------------
 1 file changed, 5 insertions(+), 13 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c
index a6eb18830cd9..fc380e59c740 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c
@@ -258,27 +258,19 @@ int iwl_mvm_mld_add_aux_sta(struct iwl_mvm *mvm, u32 lmac_id)
 				       IWL_MAX_TID_COUNT, NULL);
 }
 
-static int iwl_mvm_mld_disable_txq(struct iwl_mvm *mvm,
-				   struct ieee80211_sta *sta,
+static int iwl_mvm_mld_disable_txq(struct iwl_mvm *mvm, int sta_id,
 				   u16 *queueptr, u8 tid)
 {
-	struct iwl_mvm_sta *mvmsta;
 	int queue = *queueptr;
 	int ret = 0;
 
-	if (!sta)
-		return -EINVAL;
-
-	mvmsta = iwl_mvm_sta_from_mac80211(sta);
-
 	if (mvm->sta_remove_requires_queue_remove) {
 		u32 cmd_id = WIDE_ID(DATA_PATH_GROUP,
 				     SCD_QUEUE_CONFIG_CMD);
 		struct iwl_scd_queue_cfg_cmd remove_cmd = {
 			.operation = cpu_to_le32(IWL_SCD_QUEUE_REMOVE),
 			.u.remove.tid = cpu_to_le32(tid),
-			.u.remove.sta_mask =
-				cpu_to_le32(BIT(mvmsta->deflink.sta_id)),
+			.u.remove.sta_mask = cpu_to_le32(BIT(sta_id)),
 		};
 
 		ret = iwl_mvm_send_cmd_pdu(mvm, cmd_id, 0,
@@ -308,7 +300,7 @@ static int iwl_mvm_mld_rm_int_sta(struct iwl_mvm *mvm,
 	if (flush)
 		iwl_mvm_flush_sta(mvm, int_sta, true);
 
-	iwl_mvm_mld_disable_txq(mvm, NULL, queuptr, tid);
+	iwl_mvm_mld_disable_txq(mvm, int_sta->sta_id, queuptr, tid);
 
 	ret = iwl_mvm_mld_rm_sta_from_fw(mvm, int_sta->sta_id);
 	if (ret)
@@ -536,8 +528,8 @@ static void iwl_mvm_mld_disable_sta_queues(struct iwl_mvm *mvm,
 		if (mvm_sta->tid_data[i].txq_id == IWL_MVM_INVALID_QUEUE)
 			continue;
 
-		iwl_mvm_mld_disable_txq(mvm, sta, &mvm_sta->tid_data[i].txq_id,
-					i);
+		iwl_mvm_mld_disable_txq(mvm, mvm_sta->deflink.sta_id,
+					&mvm_sta->tid_data[i].txq_id, i);
 		mvm_sta->tid_data[i].txq_id = IWL_MVM_INVALID_QUEUE;
 	}
 
-- 
2.38.1