[PATCH ath-next v6] wifi: ath12k: avoid dynamic alloc when parsing wmi tb

[Nicolas Escande]

On Sat Apr 4, 2026 at 11:48 AM CEST, Rameshkumar Sundaram wrote:
[...]
>> @@ -134,6 +136,10 @@ struct wmi_pdev_set_obss_bitmap_arg {
>>   	const char *label;
>>   };
>>   
>> +static DEFINE_MUTEX(ath12k_wmi_mutex);
>> +static refcount_t ath12k_wmi_refcount = REFCOUNT_INIT(0);
>> +static void __percpu *ath12k_wmi_tb = NULL;
>
> Checkpatch complains:
> drivers/net/wireless/ath/ath12k/wmi.c:141: do not initialise statics to NULL
I forgot to run checkpatch on this one.
>
>> +
>>   static const struct ath12k_wmi_tlv_policy ath12k_wmi_tlv_policies[] = {
>>   	[WMI_TAG_ARRAY_BYTE] = { .min_len = 0 },
>>   	[WMI_TAG_ARRAY_UINT32] = { .min_len = 0 },
[...]
>> @@ -11239,3 +11150,28 @@ int ath12k_wmi_send_mlo_link_set_active_cmd(struct ath12k_base *ab,
>>   	dev_kfree_skb(skb);
>>   	return ret;
>>   }
>> +
>> +int ath12k_wmi_alloc(void)
>> +{
>> +	guard(mutex)(&ath12k_wmi_mutex);
>> +
>> +	if (!ath12k_wmi_tb) {
>> +		ath12k_wmi_tb = __alloc_percpu(WMI_TAG_MAX * sizeof(void *),
>> +					       __alignof__(void *));
>> +		if (!ath12k_wmi_tb)
>> +			return -ENOMEM;
>> +	}
>> +
>> +	refcount_inc(&ath12k_wmi_refcount);
>
> With ath12k_wmi_refcount initialized to zero, this will trigger addition 
> on 0 - use-after-free warning in refcount.
Arf, that a bummer.
>
> We may have to do refcount_set(&ath12k_wmi_refcount, 1); on tb alloc.
>
It seems thats the best way to go forward indeed.
>
>> +	return 0;
>> +}
>> +
>> +void ath12k_wmi_free(void)
>> +{
>> +	guard(mutex)(&ath12k_wmi_mutex);
>> +
>> +	if (refcount_dec_and_test(&ath12k_wmi_refcount)) {
>> +		free_percpu(ath12k_wmi_tb);
>> +		ath12k_wmi_tb = NULL;
>> +	}
>> +}