Re: [PATCH] wifi: rtw88: usb: drop RX frames received before the device is started

[Luka Gejak]

On Fri Oct 16, 2026 at 6:19 PM CEST, YuanZhe Liu wrote:
> rtw_usb_probe() submits the bulk-in RX URBs at the end of probe, right
> after rtw_register_hw(). A device can already have data queued on that
> endpoint, so rtw_usb_read_port_complete() runs and queues the frame on
> rtwusb->rx_queue before any interface has been brought up. Submitting
> the URBs late does not close that window: the frame can arrive as soon
> as they are submitted, which is still before the device is started.
>
> rtw_usb_rx_handler() hands every non-C2H frame to mac80211 without
> checking whether the device is running, so ieee80211_rx_irqsafe() runs
> while local->started is still false. mac80211 treats that as a driver
> bug and warns in ieee80211_rx_list():
>
>   WARNING: net/mac80211/rx.c:5601 at ieee80211_rx_list
>    Call Trace:
>     <IRQ>
>     ieee80211_rx_napi
>     ieee80211_rx
>     ieee80211_handle_queued_frames
>     <TASK>
>     rtw_usb_rx_resubmit
>     rtw_usb_setup_rx
>     rtw_usb_probe
>
> The frame is dropped by mac80211 anyway, and because the URB is
> resubmitted from its completion handler, every further frame repeats the
> warning, which floods the log until an interface is actually started.
>
> rtw_ops_tx() already drops frames outside of start/stop by checking
> RTW_FLAG_RUNNING, which mirrors local->started: it is set at the end of
> rtw_core_start() and cleared at the beginning of rtw_core_stop(). Use
> the same check in the RX path and free the frame while the device is not
> running. This also covers the opposite ordering, where a frame that is
> still queued in rtwusb->rx_queue is handed over after the device has
> been stopped again.
>
> C2H packets are left untouched: they go to the firmware event queue
> handled by rtw_fw_c2h_cmd_rx_irqsafe() and are never passed to mac80211.
>
> Fixes: a82dfd33d123 ("wifi: rtw88: Add common USB chip support")
> Cc: stable@xxxxxxxxxxxxxxx
> Co-developed-by: Bin Yu <byu@xxxxxxxxxxxxx>
> Signed-off-by: Bin Yu <byu@xxxxxxxxxxxxx>
> Co-developed-by: Cheng Wen <wencheng@xxxxxxxxxxxxx>
> Signed-off-by: Cheng Wen <wencheng@xxxxxxxxxxxxx>
> Signed-off-by: YuanZhe Liu <25031212351@xxxxxxxxxxxxxxxxx>
> ---

Looks good to me.

Reviewed-by: Luka Gejak <luka.gejak@xxxxxxxxx>

Best regards,
Luka Gejak