[PATCH v2 0/5] wifi: ath: avoid IDR mutation while iterating

[Jeff Johnson]

On 10/11/2026 10:52 PM, Baochen Qiang wrote:
> 
> 
> On 10/3/2026 5:20 PM, Jiale Yao wrote:
>> The ath10k, ath11k, and ath12k cleanup paths walk an IDR while removing
>> the current entry. idr_for_each() retains radix-tree iterator state across
>> the callback, so that removal can invalidate the walk.
>>
>> Use idr_for_each_entry() in each cleanup path. It performs a fresh
>> idr_get_next() lookup for every iteration, allowing the current entry to
>> be removed safely before its skb is released. Keeping the existing locked
>> removal helpers also ensures that a concurrent TX completion cannot find
>> an IDR entry which points to an already freed skb.
>>
>> Changes in v2:
>> - Rework the ath11k and ath12k pending management TX cleanup patches to
>>   remove each IDR entry before freeing its skb, as pointed out by
>>   Rameshkumar and Jeff.
>> - Use idr_for_each_entry() for the pending cleanup callers instead of
>>   leaving freed skb pointers in the IDR until idr_destroy().
>>
>> Jiale Yao (5):
>>   wifi: ath10k: avoid IDR mutation during TX cleanup
>>   wifi: ath11k: avoid IDR mutation during pending mgmt TX cleanup
>>   wifi: ath11k: avoid IDR mutation during vif mgmt TX cleanup
>>   wifi: ath12k: avoid IDR mutation during pending mgmt TX cleanup
>>   wifi: ath12k: avoid IDR mutation during vif mgmt TX cleanup
>>
>>  drivers/net/wireless/ath/ath10k/htt_tx.c |  7 ++++-
>>  drivers/net/wireless/ath/ath11k/core.c   |  3 +--
>>  drivers/net/wireless/ath/ath11k/mac.c    | 33 ++++++++++++------------
>>  drivers/net/wireless/ath/ath11k/mac.h    |  2 +-
>>  drivers/net/wireless/ath/ath12k/core.c   |  3 +--
>>  drivers/net/wireless/ath/ath12k/mac.c    | 33 ++++++++++++------------
>>  drivers/net/wireless/ath/ath12k/mac.h    |  2 +-
>>  7 files changed, 44 insertions(+), 39 deletions(-)
>>
> 
> if you want to go with current state, leaving the UAF risk in patches 2/5 and 3/5 in a
> separate future fix:
> 
> Reviewed-by: Baochen Qiang <baochen.qiang at oss.qualcomm.com>

Since the UAF potential is pre-existing, let's fix that separately.
So this series fixes the IDR mutation and another fixes the possible skb UAF.

/jeff