ath12k_wifi7_dp_rx_process_wbm_err() replenishes RX buffers belonging to a partner device, but passes the current device's DP object while using the partner device's refill ring. This can map replacement buffers with the wrong DMA device and access the wrong RX descriptor state in multi-device setups. Use the partner device's DP object consistently when replenishing its RX buffers. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3 Fixes: 1d18b197bc4b ("wifi: ath12k: add partner device buffer support in receive data path") Signed-off-by: Lorenzo Bianconi --- drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c b/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c index 95d87dd67872..c3e4ec0ac281 100644 --- a/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c +++ b/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c @@ -2052,7 +2052,7 @@ int ath12k_wifi7_dp_rx_process_wbm_err(struct ath12k_dp *dp, partner_dp = ath12k_dp_hw_grp_to_dp(dp_hw_grp, device_id); rx_ring = &partner_dp->rx_refill_buf_ring; - ath12k_dp_rx_bufs_replenish(dp, rx_ring, + ath12k_dp_rx_bufs_replenish(partner_dp, rx_ring, &rx_desc_used_list[device_id], num_buffs_reaped[device_id]); } --- base-commit: 08a3f02fea636e97a7422d1512f76dacdb5b0887 change-id: 20261017-ath12k_wifi7_dp_rx_process_wbm_err-fix-dp-replenish-2c7ec293f37e Best regards, -- Lorenzo Bianconi