[PATCH ath-next v2 0/2] wifi: ath12k: fix peer delete race in MLO scenario

[Rameshkumar Sundaram]

On 6/29/2026 12:31 PM, Baochen Qiang wrote:
> Patch 1 fixes a pre-existing UAF in ath12k_mac_vdev_create()'s
> err_peer_del rollback path.
> 
> Patch 2 fixes "Timeout in receiving peer delete response" on MLO
> disconnect, caused by a per-radio shared completion that gets
> clobbered between back-to-back WMI peer_delete sends.
> 
> Signed-off-by: Baochen Qiang <baochen.qiang at oss.qualcomm.com>
> ---
> Changes in v2:
> - rebased on ToT
> - patch 2/2: make ath12k_peer_delete_wait_register()
>               and ath12k_peer_delete_wait_unregister() static to peer.c
> - Link to v1: https://lore.kernel.org/r/20260617-ath12k-mlo-peer-delete-race-v1-0-ab3c4f455dfb@oss.qualcomm.com
> 
> ---
> Baochen Qiang (2):
>        wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback
>        wifi: ath12k: fix MLO peer delete race
> 
>   drivers/net/wireless/ath/ath12k/core.c |   2 +-
>   drivers/net/wireless/ath/ath12k/core.h |   5 +-
>   drivers/net/wireless/ath/ath12k/mac.c  |  20 +----
>   drivers/net/wireless/ath/ath12k/peer.c | 130 ++++++++++++++++++++++++++-------
>   drivers/net/wireless/ath/ath12k/peer.h |  14 +++-
>   drivers/net/wireless/ath/ath12k/wmi.c  |  16 ++--
>   6 files changed, 133 insertions(+), 54 deletions(-)
> ---
> base-commit: 1547a99cd8d8c1ab3e04dbd92b72b3b5f7cb85a9
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram at oss.qualcomm.com>