ath11k_mac_register() initializes ar->txmgmt_empty_waitq only after __ath11k_mac_register() has returned, but __ath11k_mac_register() calls ieee80211_register_hw(). From that point on userspace can transmit management frames (iwd starts authenticating as soon as the wiphy shows up), and a WMI mgmt TX completion event then ends up in wmi_process_mgmt_tx_comp(), which calls wake_up() on the not yet initialized wait queue head: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:__wake_up+0x5a/0xf0 Call Trace: ath11k_wmi_tlv_op_rx+0x174c/0x32b0 [ath11k] ath11k_htc_rx_completion_handler+0x4fd/0x670 [ath11k] ath11k_ce_per_engine_service+0x2b2/0x380 [ath11k] ath11k_pcic_ce_tasklet+0x1d/0x40 [ath11k] tasklet_action_common+0x186/0x290 handle_softirqs+0xe8/0x2a0 ... Kernel panic - not syncing: Fatal exception in interrupt The window is normally very short. The panic above was hit at boot with an msleep(2000) inserted after ieee80211_register_hw() for testing, while iwd authenticated to an AP during the delay. Initialize the wait queue together with the rest of the txmgmt state, before registering, as ath12k already does. Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-05266-QCAHSTSWPLZ_V2_TO_X86-1 Fixes: dddaa64d0af3 ("ath11k: add wait operation for tx management packets for flush from mac80211") Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Nikolay Bryskin --- drivers/net/wireless/ath/ath11k/mac.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c index c1fa42edd363..3dfd24d7b5a6 100644 --- a/drivers/net/wireless/ath/ath11k/mac.c +++ b/drivers/net/wireless/ath/ath11k/mac.c @@ -10738,12 +10738,11 @@ int ath11k_mac_register(struct ath11k_base *ab) idr_init(&ar->txmgmt_idr); spin_lock_init(&ar->txmgmt_idr_lock); + init_waitqueue_head(&ar->txmgmt_empty_waitq); ret = __ath11k_mac_register(ar); if (ret) goto err_cleanup; - - init_waitqueue_head(&ar->txmgmt_empty_waitq); } return 0; -- 2.56.0