From: Kevin Lo <kevlo@kevlo.org>
Subject: Re: fix wrong use of TAILQ pointers in qwx
To: tech@openbsd.org
Date: Sun, 31 May 2026 13:44:44 +0800

On Sat, May 30, 2026 at 02:59:26PM +0200, Stefan Sperling wrote:
> 
> This code is passing wrong list head pointers to TAILQ macros.
> Spotted while working on something else (will send another diff soon).
> 
> OK?
>  
> M  sys/dev/ic/qwx.c  |  3+  3-
> 
> 1 file changed, 3 insertions(+), 3 deletions(-)
> 
> commit - a909ce865e74a511e28b42ea08c62da4ee2f2672
> commit + df013094d758e1986e1a9698533920fe7c095993
> blob - 8998915d177d473d0a43a3060cbd36954545ed06
> blob + 2dc4ad99a17b4ea9165e041fb26d3ec5bc7bde3e
> --- sys/dev/ic/qwx.c
> +++ sys/dev/ic/qwx.c
> @@ -16811,8 +16811,8 @@ qwx_dp_rx_process_wbm_err(struct qwx_softc *sc, int pu
>  
>  	if (purge) {
>  		for (i = 0; i < sc->num_radios; i++) {
> -			while ((msdu = TAILQ_FIRST(msdu_list))) {
> -				TAILQ_REMOVE(msdu_list, msdu, entry);
> +			while ((msdu = TAILQ_FIRST(&msdu_list[i]))) {
> +				TAILQ_REMOVE(&msdu_list[i], msdu, entry);
>  				m_freem(msdu->m);
>  				msdu->m = NULL;
>  			}
> @@ -17633,7 +17633,7 @@ try_again:
>  
>  		if (purge) {
>  			while ((msdu = TAILQ_FIRST(&msdu_list[i]))) {
> -				TAILQ_REMOVE(msdu_list, msdu, entry);
> +				TAILQ_REMOVE(&msdu_list[i], msdu, entry);
>  				m_freem(msdu->m);
>  				msdu->m = NULL;
>  			}
> 

While looking at this, I noticed qwx_dp_rx_process_wbm_err() has a third 
spot with the same pattern that isn't covered by your diff.

Index: sys/dev/ic/qwx.c
===================================================================
RCS file: /cvs/src/sys/dev/ic/qwx.c,v
diff -u -p -u -p -r1.119 qwx.c
--- sys/dev/ic/qwx.c	29 May 2026 09:52:10 -0000	1.119
+++ sys/dev/ic/qwx.c	31 May 2026 05:31:13 -0000
@@ -16811,8 +16811,8 @@ qwx_dp_rx_process_wbm_err(struct qwx_sof
 
 	if (purge) {
 		for (i = 0; i < sc->num_radios; i++) {
-			while ((msdu = TAILQ_FIRST(msdu_list))) {
-				TAILQ_REMOVE(msdu_list, msdu, entry);
+			while ((msdu = TAILQ_FIRST(&msdu_list[i]))) {
+				TAILQ_REMOVE(&msdu_list[i], msdu, entry);
 				m_freem(msdu->m);
 				msdu->m = NULL;
 			}
@@ -16831,8 +16831,8 @@ qwx_dp_rx_process_wbm_err(struct qwx_sof
 	}
 
 	for (i = 0; i < sc->num_radios; i++) {
-		while ((msdu = TAILQ_FIRST(msdu_list))) {
-			TAILQ_REMOVE(msdu_list, msdu, entry);
+		while ((msdu = TAILQ_FIRST(&msdu_list[i]))) {
+			TAILQ_REMOVE(&msdu_list[i], msdu, entry);
 			if (test_bit(ATH11K_CAC_RUNNING, sc->sc_flags)) {
 				m_freem(msdu->m);
 				msdu->m = NULL;
@@ -17633,7 +17633,7 @@ try_again:
 
 		if (purge) {
 			while ((msdu = TAILQ_FIRST(&msdu_list[i]))) {
-				TAILQ_REMOVE(msdu_list, msdu, entry);
+				TAILQ_REMOVE(&msdu_list[i], msdu, entry);
 				m_freem(msdu->m);
 				msdu->m = NULL;
 			}