[PATCH v2 0/5] wifi: ath: avoid IDR mutation while iterating

[Jiale Yao]

The ath10k, ath11k, and ath12k cleanup paths walk an IDR while removing
the current entry. idr_for_each() retains radix-tree iterator state across
the callback, so that removal can invalidate the walk.

Use idr_for_each_entry() in each cleanup path. It performs a fresh
idr_get_next() lookup for every iteration, allowing the current entry to
be removed safely before its skb is released. Keeping the existing locked
removal helpers also ensures that a concurrent TX completion cannot find
an IDR entry which points to an already freed skb.

Changes in v2:
- Rework the ath11k and ath12k pending management TX cleanup patches to
  remove each IDR entry before freeing its skb, as pointed out by
  Rameshkumar and Jeff.
- Use idr_for_each_entry() for the pending cleanup callers instead of
  leaving freed skb pointers in the IDR until idr_destroy().

Jiale Yao (5):
  wifi: ath10k: avoid IDR mutation during TX cleanup
  wifi: ath11k: avoid IDR mutation during pending mgmt TX cleanup
  wifi: ath11k: avoid IDR mutation during vif mgmt TX cleanup
  wifi: ath12k: avoid IDR mutation during pending mgmt TX cleanup
  wifi: ath12k: avoid IDR mutation during vif mgmt TX cleanup

 drivers/net/wireless/ath/ath10k/htt_tx.c |  7 ++++-
 drivers/net/wireless/ath/ath11k/core.c   |  3 +--
 drivers/net/wireless/ath/ath11k/mac.c    | 33 ++++++++++++------------
 drivers/net/wireless/ath/ath11k/mac.h    |  2 +-
 drivers/net/wireless/ath/ath12k/core.c   |  3 +--
 drivers/net/wireless/ath/ath12k/mac.c    | 33 ++++++++++++------------
 drivers/net/wireless/ath/ath12k/mac.h    |  2 +-
 7 files changed, 44 insertions(+), 39 deletions(-)

-- 
2.34.1