Skip to contentSkip to conversation

wifi: rtw89: correct use sequence of driver_data in skb->info

PATCH In review Ping-Ke Shih 2 participants 3 messages Dec 17, 2025 – Dec 23, 2025 Realtek wireless driver (rtw89)

lore
Share & tools
lore

Ping-Ke Shih

author maintainer
#0 lore raw

PATCH 1/1 wifi: rtw89: correct use sequence of driver_data in skb->info

As ieee80211_tx_info is used to assist filling TX descriptor, and layout of IEEE80211_SKB_CB(skb)->driver_data (accessing by RTW89_TX_SKB_CB()) is union, so driver_data must be used by/after rtw89_hci_tx_write() or just before calling rtw89_hci_tx_write(). Otherwise, ieee80211_tx_info::control data is overwritten.

Found this by using injected packets which uses ieee80211_tx_info::control, but always sending incorrect data rate.

Cc Fedor Pchelkin <[email protected]>
Fixes d5da3d9fb05f ("wifi: rtw89: process TX wait skbs for USB via C2H handler")
Signed-off-by Ping-Ke Shih <[email protected]>

---
I'd let this patch go via rtw-next tree, because this change is conflict with coming rtw-next patches, and actually this affects injected packets function only which I'd consider as a debug function.

---
 drivers/net/wireless/realtek/rtw89/core.c | 6 ++++--
 drivers/net/wireless/realtek/rtw89/core.h | 2 ++
 2 files changed, 6 insertions(+), 2 deletions(-)
drivers/net/wireless/realtek/rtw89/core.c +4 -2
index 0824940c91ae..53d32f3137eb 100644
@@ -1207,7 +1207,7 @@ rtw89_core_tx_update_desc_info(struct rtw89_dev *rtwdev,
 	if (addr_cam->valid && desc_info->mlo)
 		upd_wlan_hdr = true;
 
-	if (rtw89_is_tx_rpt_skb(rtwdev, tx_req->skb))
+	if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS || tx_req->with_wait)
 		rtw89_tx_rpt_init(rtwdev, tx_req);
 
 	is_bmc = (is_broadcast_ether_addr(hdr->addr1) ||

@@ -1342,13 +1342,15 @@ static int rtw89_core_tx_write_link(struct rtw89_dev *rtwdev,
 	tx_req.rtwvif_link = rtwvif_link;
 	tx_req.rtwsta_link = rtwsta_link;
 	tx_req.desc_info.sw_mld = sw_mld;
-	rcu_assign_pointer(skb_data->wait, wait);
+	tx_req.with_wait = !!wait;
 
 	rtw89_traffic_stats_accu(rtwdev, rtwvif, skb, true, true);
 	rtw89_wow_parse_akm(rtwdev, skb);
 	rtw89_core_tx_update_desc_info(rtwdev, &tx_req);
 	rtw89_core_tx_wake(rtwdev, &tx_req);
 
+	rcu_assign_pointer(skb_data->wait, wait);
+
 	ret = rtw89_hci_tx_write(rtwdev, &tx_req);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to transmit skb to HCI\n");
drivers/net/wireless/realtek/rtw89/core.h +2 -0
index a9cb47ea0b93..92636cfc5ca5 100644
@@ -1211,6 +1211,8 @@ struct rtw89_core_tx_request {
 	struct rtw89_vif_link *rtwvif_link;
 	struct rtw89_sta_link *rtwsta_link;
 	struct rtw89_tx_desc_info desc_info;
+
+	bool with_wait;
 };
 
 struct rtw89_txq {
Signature · 1 line
2.25.1
Tested-by on v1 1/1
#1 lore raw
Quoted 9 lines · Ping-Ke Shih

As ieee80211_tx_info is used to assist filling TX descriptor, and layout of IEEE80211_SKB_CB(skb)->driver_data (accessing by RTW89_TX_SKB_CB()) is union, so driver_data must be used by/after rtw89_hci_tx_write() or just before calling rtw89_hci_tx_write(). Otherwise, ieee80211_tx_info::control data is overwritten.

Found this by using injected packets which uses ieee80211_tx_info::control, but always sending incorrect data rate.

Quoted 8 lines
Cc Fedor Pchelkin <[email protected]>
Fixes d5da3d9fb05f ("wifi: rtw89: process TX wait skbs for USB via C2H handler")
Signed-off-by Ping-Ke Shih <[email protected]>

---
I'd let this patch go via rtw-next tree, because this change is conflict with coming rtw-next patches, and actually this affects injected packets function only which I'd consider as a debug function.
---

Thanks!

For the skb-waiting part

Tested-by Fedor Pchelkin <[email protected]>
author maintainer
#2 lore raw
In reply to Ping-Ke Shih
Quoted 6 lines · Ping-Ke Shih

As ieee80211_tx_info is used to assist filling TX descriptor, and layout of IEEE80211_SKB_CB(skb)->driver_data (accessing by RTW89_TX_SKB_CB()) is union, so driver_data must be used by/after rtw89_hci_tx_write() or just before calling rtw89_hci_tx_write(). Otherwise, ieee80211_tx_info::control data is overwritten.

Quoted 7 lines

Found this by using injected packets which uses ieee80211_tx_info::control, but always sending incorrect data rate.

Cc Fedor Pchelkin <[email protected]>
Fixes d5da3d9fb05f ("wifi: rtw89: process TX wait skbs for USB via C2H handler")
Signed-off-by Ping-Ke Shih <[email protected]>
Tested-by Fedor Pchelkin <[email protected]>

1 patch(es) applied to rtw-next branch of rtw.git, thanks.

d3a9e132a4c6 wifi: rtw89: correct use sequence of driver_data in skb->info

---
https://github.com/pkshih/rtw.git