When handling a DELBA request, ath11k_dp_rx_ampdu_stop() calls ath11k_peer_rx_tid_reo_update() to tear down the BA session for the specified TID. However, it currently passes peer->rx_tid instead of the entry corresponding to params->tid. Since peer->rx_tid is an array, this decays to a pointer to the first element, effectively operating on TID 0 regardless of the TID in the DELBA request. As a result, the BA session for TID 0 is stopped while the intended TID remains active. This leads to incorrect BA session state and may significantly reduce RX throughput, as traffic that should use aggregation falls back to a BA window size of 1 on TID 0. Fix this by passing the correct TID entry: &peer->rx_tid[params->tid] Fixes: fe201947f8bd ("ath11k: update bawindow size in delba process") Signed-off-by: Pablo Martin-Gomez --- drivers/net/wireless/ath/ath11k/dp_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c index b9e976ddcbbf..8db04c38dfba 100644 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c @@ -1132,7 +1132,7 @@ int ath11k_dp_rx_ampdu_stop(struct ath11k *ar, return 0; } - ret = ath11k_peer_rx_tid_reo_update(ar, peer, peer->rx_tid, 1, 0, false); + ret = ath11k_peer_rx_tid_reo_update(ar, peer, &peer->rx_tid[params->tid], 1, 0, false); spin_unlock_bh(&ab->base_lock); if (ret) { ath11k_warn(ab, "failed to update reo for rx tid %d: %d\n", -- 2.43.0