-----Original Message-----
From: Chris Bainbridge <redacted>
Sent: Monday, January 26, 2026 1:34 AM
To: Korenblit, Miriam Rachel <miriam.rachel.korenblit@intel.com>;
kvalo@kernel.org
Cc: Berg, Johannes <redacted>; benjamin@sipsolutions.net;
gustavoars@kernel.org; linux-intel-wifi@intel.com; linux-
wireless@vger.kernel.org; netdev@vger.kernel.org; linux-
kernel@vger.kernel.org; Chris Bainbridge [off-list ref];
stable@vger.kernel.org
Subject: [PATCH] Revert "wifi: iwlwifi: trans: remove STATUS_SUSPENDED"

This reverts commit e769f6f27ffe41331e00b69a33aa8a34db4dd830.

The removal of STATUS_SUSPENDED (which tracks suspend/resume state)
resulted in an intermittent race condition on resume. The fault can be
reproduced by carrying out repeated suspend/resume cycles while passing
traffic through the NIC. A typical failure looks like:

[  141.093986] iwlwifi 0000:01:00.0: Error sending SCAN_CFG_CMD: time out
after 2000ms.
[  141.094057] iwlwifi 0000:01:00.0: Current CMD queue read_ptr 441
write_ptr 442 [  141.094864] iwlwifi 0000:01:00.0: Start IWL Error Log Dump:
[  141.094866] iwlwifi 0000:01:00.0: Transport status: 0x00000042, valid: 6 [
141.094870] iwlwifi 0000:01:00.0: Loaded firmware version: 89.7f71c7f4.0 ty-
a0-gf-a0-89.ucode [  141.094873] iwlwifi 0000:01:00.0: 0x01000071 |
ADVANCED_SYSASSERT ...
[  141.098401] iwlwifi 0000:01:00.0: iwl_mvm_check_rt_status failed, device is
gone during suspend

The kernel then oops due to a null pointer dereference in
iwl_mvm_realloc_queues_after_restart().

Fixes: e769f6f27ffe ("wifi: iwlwifi: trans: remove STATUS_SUSPENDED")
Closes: https://yhbt.net/lore/linux-
wireless/aTDoDiD55qlUZ0pn@debian.local/
Cc: <redacted>
Signed-off-by: Chris Bainbridge <redacted>
---
 .../net/wireless/intel/iwlwifi/iwl-trans.c    | 22 +++++++++++++++++--
 .../net/wireless/intel/iwlwifi/iwl-trans.h    |  3 +++
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.c

b/drivers/net/wireless/intel/iwlwifi/iwl-trans.c
index cc8a84018f70..f5c4aa165c5b 100644

--- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.c

@@ -306,6 +306,9 @@ int iwl_trans_send_cmd(struct iwl_trans *trans, struct

iwl_host_cmd *cmd)
 		     test_bit(STATUS_RFKILL_OPMODE, &trans->status)))
 		return -ERFKILL;

+	if (unlikely(test_bit(STATUS_SUSPENDED, &trans->status)))
+		return -EHOSTDOWN;
+
 	if (unlikely(test_bit(STATUS_FW_ERROR, &trans->status)))
 		return -EIO;

@@ -406,6 +409,8 @@ int iwl_trans_start_hw(struct iwl_trans *trans)
 	might_sleep();

 	clear_bit(STATUS_TRANS_RESET_IN_PROGRESS, &trans->status);
+	/* opmode may not resume if it detects errors */
+	clear_bit(STATUS_SUSPENDED, &trans->status);

 	return iwl_trans_pcie_start_hw(trans);  } @@ -505,17 +510,30 @@

iwl_trans_dump_data(struct iwl_trans *trans, u32 dump_mask,

 int iwl_trans_d3_suspend(struct iwl_trans *trans, bool reset)  {
+	int err;
+
 	might_sleep();

-	return iwl_trans_pcie_d3_suspend(trans, reset);
+	err = iwl_trans_pcie_d3_suspend(trans, reset);
+
+	if (!err)
+		set_bit(STATUS_SUSPENDED, &trans->status);
+
+	return err;
 }
 IWL_EXPORT_SYMBOL(iwl_trans_d3_suspend);

 int iwl_trans_d3_resume(struct iwl_trans *trans, bool reset)  {
+	int err;
+
 	might_sleep();

-	return iwl_trans_pcie_d3_resume(trans, reset);
+	err = iwl_trans_pcie_d3_resume(trans, reset);
+
+	clear_bit(STATUS_SUSPENDED, &trans->status);
+
+	return err;
 }
 IWL_EXPORT_SYMBOL(iwl_trans_d3_resume);

diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h

b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
index a552669db6e2..c4d06a323f9b 100644

--- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h

@@ -290,6 +290,8 @@ static inline void iwl_free_rxb(struct

iwl_rx_cmd_buffer *r)
  *	the firmware state yet
  * @STATUS_TRANS_RESET_IN_PROGRESS: reset is still in progress, don't
  *	attempt another reset yet
+ * @STATUS_SUSPENDED: device is suspended, don't send commands that
+ *	aren't marked accordingly
  */
 enum iwl_trans_status {
 	STATUS_SYNC_HCMD_ACTIVE,

@@ -303,6 +305,7 @@ enum iwl_trans_status {
 	STATUS_IN_SW_RESET,
 	STATUS_RESET_PENDING,
 	STATUS_TRANS_RESET_IN_PROGRESS,
+	STATUS_SUSPENDED,
 };

 static inline int
--

2.47.3