From 5406c2792ae4e478e71bc030cecb8673f59434d8 Mon Sep 17 00:00:00 2001 From: stsp Date: Sun, 31 May 2026 13:20:20 +0000 Subject: [PATCH] Fix use of wrong tailq pointers in qwx. Fortunately, this was a non-issue on devices with single radios and there are no multi-radio devices known to us so far. With help from kevlo@ who spotted a case I had missed. --- sys/dev/ic/qwx.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/sys/dev/ic/qwx.c b/sys/dev/ic/qwx.c index 8998915d177..cbcf174b4c3 100644 --- a/sys/dev/ic/qwx.c +++ b/sys/dev/ic/qwx.c @@ -1,4 +1,4 @@ -/* $OpenBSD: qwx.c,v 1.119 2026/05/29 09:52:10 stsp Exp $ */ +/* $OpenBSD: qwx.c,v 1.120 2026/05/31 13:20:20 stsp Exp $ */ /* * Copyright 2023 Stefan Sperling @@ -16811,8 +16811,8 @@ qwx_dp_rx_process_wbm_err(struct qwx_softc *sc, int purge) if (purge) { for (i = 0; i < sc->num_radios; i++) { - while ((msdu = TAILQ_FIRST(msdu_list))) { - TAILQ_REMOVE(msdu_list, msdu, entry); + while ((msdu = TAILQ_FIRST(&msdu_list[i]))) { + TAILQ_REMOVE(&msdu_list[i], msdu, entry); m_freem(msdu->m); msdu->m = NULL; } @@ -16831,8 +16831,8 @@ qwx_dp_rx_process_wbm_err(struct qwx_softc *sc, int purge) } for (i = 0; i < sc->num_radios; i++) { - while ((msdu = TAILQ_FIRST(msdu_list))) { - TAILQ_REMOVE(msdu_list, msdu, entry); + while ((msdu = TAILQ_FIRST(&msdu_list[i]))) { + TAILQ_REMOVE(&msdu_list[i], msdu, entry); if (test_bit(ATH11K_CAC_RUNNING, sc->sc_flags)) { m_freem(msdu->m); msdu->m = NULL; @@ -17633,7 +17633,7 @@ try_again: if (purge) { while ((msdu = TAILQ_FIRST(&msdu_list[i]))) { - TAILQ_REMOVE(msdu_list, msdu, entry); + TAILQ_REMOVE(&msdu_list[i], msdu, entry); m_freem(msdu->m); msdu->m = NULL; }