wifi: iwlwifi: pcie: null RX pointers after free

When iwl_pcie_tx_init() fails after RX init, nic init unwinds via
iwl_pcie_rx_free().

The freed RX members stayed non-NULL on the live transport object,
so later teardown or retry could touch stale RX state.
Set rx_pool, global_table, rxq, and alloc_page to NULL after free
to make repeated cleanup and retry paths safe.

Assisted-by: GitHubCopilot:gpt-5.3-codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260714141909.33e8978d8b36.Ibaedd4b0ce01405b940de7b90223b6d2c5136ffd@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c
index fe263cdc2e4f41e8b0641270f52b4bff52946b3c..4631e11f2a964d948c4b25cee8a88bfa252e16a2 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
- * Copyright (C) 2003-2014, 2018-2024 Intel Corporation
+ * Copyright (C) 2003-2014, 2018-2024, 2026 Intel Corporation
  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
  * Copyright (C) 2016-2017 Intel Deutschland GmbH
  */
@@ -1238,11 +1238,16 @@ void iwl_pcie_rx_free(struct iwl_trans *trans)
                }
        }
        kfree(trans_pcie->rx_pool);
+       trans_pcie->rx_pool = NULL;
        kfree(trans_pcie->global_table);
+       trans_pcie->global_table = NULL;
        kfree(trans_pcie->rxq);
+       trans_pcie->rxq = NULL;
 
-       if (trans_pcie->alloc_page)
+       if (trans_pcie->alloc_page) {
                __free_pages(trans_pcie->alloc_page, trans_pcie->rx_page_order);
+               trans_pcie->alloc_page = NULL;
+       }
 }
 
 static void iwl_pcie_rx_move_to_allocator(struct iwl_rxq *rxq,