[PATCH ath-current] wifi: ath12k: fix wrong TID passed when stopping AMPDU session

Jeff Johnson jeff.johnson at oss.qualcomm.com
Mon Jan 26 09:28:26 PST 2026


On 1/26/2026 3:35 AM, Pablo MARTIN-GOMEZ wrote:
> When handling a DELBA request, ath12k_dp_rx_ampdu_stop() calls
> ath12k_peer_rx_tid_reo_update() to tear down the BA session for the
> specified TID. However, it currently passes peer->rx_tid instead of the
> entry corresponding to params->tid.
> 
> Since peer->rx_tid is an array, this decays to a pointer to the first
> element, effectively operating on TID 0 regardless of the TID in the
> DELBA request. As a result, the BA session for TID 0 is stopped while
> the intended TID remains active.
> 
> This leads to incorrect BA session state and may significantly reduce
> RX throughput, as traffic that should use aggregation falls back to a
> BA window size of 1 on TID 0.
> 
> Fix this by passing the correct TID entry:
>    &peer->rx_tid[params->tid]
> 
> Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
> Signed-off-by: Pablo Martin-Gomez <pmartin-gomez at freebox.fr>
> ---
>   drivers/net/wireless/ath/ath12k/dp_rx.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c 
> b/drivers/net/wireless/ath/ath12k/dp_rx.c
> index d28d8ffec0f8..f2327c82953b 100644
> --- a/drivers/net/wireless/ath/ath12k/dp_rx.c
> +++ b/drivers/net/wireless/ath/ath12k/dp_rx.c
> @@ -1289,7 +1289,7 @@ int ath12k_dp_rx_ampdu_stop(struct ath12k *ar,
>           return 0;
>       }
> 
> -    ret = ath12k_peer_rx_tid_reo_update(ar, peer, peer->rx_tid, 1, 0, 
> false);
> +    ret = ath12k_peer_rx_tid_reo_update(ar, peer, 
> &peer->rx_tid[params->tid], 1, 0, false);

FYI your e-mail client is munging your patch, adding a line break.
And using "view source" it looks like other artifacts are being added.
My tooling (using 'b4') cannot process your patch...

Applying: wifi: ath12k: fix wrong TID passed when stopping AMPDU session
error: git diff header lacks filename information when removing 1 leading pathname component (line 6)

Suggest using https://b4.docs.kernel.org/en/latest/contributor/overview.html

>       spin_unlock_bh(&ab->base_lock);
>       if (ret) {
>           ath12k_warn(ab, "failed to update reo for rx tid %d: %d\n",




More information about the ath12k mailing list