From: Stefan Sperling <stsp@stsp.name>
Subject: Re: fix wrong use of TAILQ pointers in qwx
To: Kevin Lo <kevlo@kevlo.org>
Cc: tech@openbsd.org
Date: Sun, 31 May 2026 09:12:23 +0200

On Sun, May 31, 2026 at 01:44:44PM +0800, Kevin Lo wrote:
> While looking at this, I noticed qwx_dp_rx_process_wbm_err() has a third 
> spot with the same pattern that isn't covered by your diff.

Nice catch, thanks!

By the way, do you know if we already support any device which has
more than one radio? My QCNFA765 seems to only have one.

> Index: sys/dev/ic/qwx.c
> ===================================================================
> RCS file: /cvs/src/sys/dev/ic/qwx.c,v
> diff -u -p -u -p -r1.119 qwx.c
> --- sys/dev/ic/qwx.c	29 May 2026 09:52:10 -0000	1.119
> +++ sys/dev/ic/qwx.c	31 May 2026 05:31:13 -0000
> @@ -16811,8 +16811,8 @@ qwx_dp_rx_process_wbm_err(struct qwx_sof
>  
>  	if (purge) {
>  		for (i = 0; i < sc->num_radios; i++) {
> -			while ((msdu = TAILQ_FIRST(msdu_list))) {
> -				TAILQ_REMOVE(msdu_list, msdu, entry);
> +			while ((msdu = TAILQ_FIRST(&msdu_list[i]))) {
> +				TAILQ_REMOVE(&msdu_list[i], msdu, entry);
>  				m_freem(msdu->m);
>  				msdu->m = NULL;
>  			}
> @@ -16831,8 +16831,8 @@ qwx_dp_rx_process_wbm_err(struct qwx_sof
>  	}
>  
>  	for (i = 0; i < sc->num_radios; i++) {
> -		while ((msdu = TAILQ_FIRST(msdu_list))) {
> -			TAILQ_REMOVE(msdu_list, msdu, entry);
> +		while ((msdu = TAILQ_FIRST(&msdu_list[i]))) {
> +			TAILQ_REMOVE(&msdu_list[i], msdu, entry);
>  			if (test_bit(ATH11K_CAC_RUNNING, sc->sc_flags)) {
>  				m_freem(msdu->m);
>  				msdu->m = NULL;
> @@ -17633,7 +17633,7 @@ try_again:
>  
>  		if (purge) {
>  			while ((msdu = TAILQ_FIRST(&msdu_list[i]))) {
> -				TAILQ_REMOVE(msdu_list, msdu, entry);
> +				TAILQ_REMOVE(&msdu_list[i], msdu, entry);
>  				m_freem(msdu->m);
>  				msdu->m = NULL;
>  			}
> 
>