[PATCH ath-current] wifi: ath12k: fix dead lock while flushing management frames

[Vasanthakumar Thiagarajan]

On 1/13/2026 7:18 AM, Baochen Qiang wrote:
> Commit [1] converted the management transmission work item into a
> wiphy work. Since a wiphy work can only run under wiphy lock
> protection, a race condition happens in below scenario:
> 
> 1. a management frame is queued for transmission.
> 2. ath12k_mac_op_flush() gets called to flush pending frames associated
>     with the hardware (i.e, vif being NULL). Then in ath12k_mac_flush()
>     the process waits for the transmission done.
> 3. Since wiphy lock has been taken by the flush process, the transmission
>     work item has no chance to run, hence the dead lock.
> 
>  From user view, this dead lock results in below issue:
> 
>   wlp8s0: authenticate with xxxxxx (local address=xxxxxx)
>   wlp8s0: send auth to xxxxxx (try 1/3)
>   wlp8s0: authenticate with xxxxxx (local address=xxxxxx)
>   wlp8s0: send auth to xxxxxx (try 1/3)
>   wlp8s0: authenticated
>   wlp8s0: associate with xxxxxx (try 1/3)
>   wlp8s0: aborting association with xxxxxx by local choice (Reason: 3=DEAUTH_LEAVING)
>   ath12k_pci 0000:08:00.0: failed to flush mgmt transmit queue, mgmt pkts pending 1
> 
> The dead lock can be avoided by invoking wiphy_work_flush() to proactively
> run the queued work item. Note actually it is already present in
> ath12k_mac_op_flush(), however it does not protect the case where vif
> being NULL. Hence move it ahead to cover this case as well.
> 
> Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
> 
> Fixes: 56dcbf0b5207 ("wifi: ath12k: convert struct ath12k::wmi_mgmt_tx_work to struct wiphy_work") # [1]
> Reported-by: Stuart Hayhurst <stuart.a.hayhurst at gmail.com>
> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220959
> Signed-off-by: Baochen Qiang <baochen.qiang at oss.qualcomm.com>

Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan at oss.qualcomm.com>