[PATCH 1/2] wifi: ath11k: initialize txmgmt_empty_waitq before registering the hw

[Nikolay Bryskin]

ath11k_mac_register() initializes ar->txmgmt_empty_waitq only after
__ath11k_mac_register() has returned, but __ath11k_mac_register() calls
ieee80211_register_hw(). From that point on userspace can transmit
management frames (iwd starts authenticating as soon as the wiphy shows
up), and a WMI mgmt TX completion event then ends up in
wmi_process_mgmt_tx_comp(), which calls wake_up() on the not yet
initialized wait queue head:

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  RIP: 0010:__wake_up+0x5a/0xf0
  Call Trace:
   <IRQ>
   ath11k_wmi_tlv_op_rx+0x174c/0x32b0 [ath11k]
   ath11k_htc_rx_completion_handler+0x4fd/0x670 [ath11k]
   ath11k_ce_per_engine_service+0x2b2/0x380 [ath11k]
   ath11k_pcic_ce_tasklet+0x1d/0x40 [ath11k]
   tasklet_action_common+0x186/0x290
   handle_softirqs+0xe8/0x2a0
   ...
  Kernel panic - not syncing: Fatal exception in interrupt

The window is normally very short. The panic above was hit at boot with
an msleep(2000) inserted after ieee80211_register_hw() for testing, while
iwd authenticated to an AP during the delay.

Initialize the wait queue together with the rest of the txmgmt state,
before registering, as ath12k already does.

Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-05266-QCAHSTSWPLZ_V2_TO_X86-1

Fixes: dddaa64d0af3 ("ath11k: add wait operation for tx management packets for flush from mac80211")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Nikolay Bryskin <nbryskin at gmail.com>
---
 drivers/net/wireless/ath/ath11k/mac.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index c1fa42edd363..3dfd24d7b5a6 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -10738,12 +10738,11 @@ int ath11k_mac_register(struct ath11k_base *ab)
 
 		idr_init(&ar->txmgmt_idr);
 		spin_lock_init(&ar->txmgmt_idr_lock);
+		init_waitqueue_head(&ar->txmgmt_empty_waitq);
 
 		ret = __ath11k_mac_register(ar);
 		if (ret)
 			goto err_cleanup;
-
-		init_waitqueue_head(&ar->txmgmt_empty_waitq);
 	}
 
 	return 0;
-- 
2.56.0