[PATCH 1/3] wifi: ath12k: fix datapath lookup in ath12k_wifi7_dp_rx_process_err()

[Jeff Johnson]

On 10/8/2026 6:15 AM, Lorenzo Bianconi wrote:
> ath12k_wifi7_dp_rx_process_err() resolves the per-pdev datapath with
> ath12k_dp_to_pdev_dp(dp, pdev_idx), using the local 'dp', while
> 'pdev_idx' is computed from the owning 'partner_dp'. As dp_pdevs[] is
> indexed per ath12k_dp, this picks the wrong pdev when the REO exception
> descriptor was sourced by a partner device in a multi-device group.
> 
> The error is currently masked by the drop condition that only processes
> same-device fragments (partner_dp->device_id == dp->device_id), but it
> is still incorrect and would misbehave as soon as that restriction is
> relaxed.
> 
> Look the pdev datapath up from partner_dp, as already done in the other
> Rx processing paths.
> 
> Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3

Tested-on is not an official upstream tag but is an ath-specific tag. There
should be a blank line separating this tag from the official tags.

No need to repost for this, I can fix it in my tree.

> Fixes: 9e0ee04f818f ("wifi: ath12k: Refactor data path pdev struct")

If this issue is masked then IMO we don't need to backport to LTS kernels and
hence should drop the fixes tag or add Cc: <stable+noautosel at kernel.org>

> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi at oss.qualcomm.com>
> ---
>  drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c b/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c
> index a32c804403e8..633cb91b9e5d 100644
> --- a/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c
> +++ b/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c
> @@ -1536,7 +1536,7 @@ int ath12k_wifi7_dp_rx_process_err(struct ath12k_dp *dp, struct napi_struct *nap
>  
>  		rcu_read_lock();
>  
> -		dp_pdev = ath12k_dp_to_pdev_dp(dp, pdev_idx);
> +		dp_pdev = ath12k_dp_to_pdev_dp(partner_dp, pdev_idx);
>  		if (!dp_pdev) {
>  			rcu_read_unlock();
>  			continue;
>