[PATCH v3 1/2] wifi: ath12k: fix crash when unbinding

[PATCH v3 1/2] wifi: ath12k: fix crash when unbinding

[Jose Ignacio Tornos Martinez]

If there is an error during some initialization related to firmware,
the function ath12k_dp_cc_cleanup is called to release resources.
However this is released again when the device is unbinded (ath12k_pci),
and we get:
BUG: kernel NULL pointer dereference, address: 0000000000000020
at RIP: 0010:ath12k_dp_cc_cleanup.part.0+0xb6/0x500 [ath12k]
Call Trace:
ath12k_dp_cc_cleanup
ath12k_dp_free
ath12k_core_deinit
ath12k_pci_remove
...

The issue is always reproducible from a VM because the MSI addressing
initialization is failing.

In order to fix the issue, just set to NULL the released structure in
ath12k_dp_cc_cleanup at the end.

cc: stable@vger.kernel.org
Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
---
v3:
  - Trim backtrace.
  - Fix typos.
v2: https://lore.kernel.org/linux-wireless/20241016123452.206671-1-jtornosm@redhat.com/
v1: https://lore.kernel.org/linux-wireless/20241010175102.207324-2-jtornosm@redhat.com/

 drivers/net/wireless/ath/ath12k/dp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c
index 61aa78d8bd8c..789d430e4455 100644
--- a/drivers/net/wireless/ath/ath12k/dp.c
+++ b/drivers/net/wireless/ath/ath12k/dp.c
@@ -1241,6 +1241,7 @@ static void ath12k_dp_cc_cleanup(struct ath12k_base *ab)
 	}
 
 	kfree(dp->spt_info);
+	dp->spt_info = NULL;
 }
 
 static void ath12k_dp_reoq_lut_cleanup(struct ath12k_base *ab)
-- 
2.46.2

Re: [PATCH v3 1/2] wifi: ath12k: fix crash when unbinding

[Jeff Johnson]

Your v3 patches look ok to me, however they are not showing up in Patchwork so
I cannot act upon them. I suspect the issue is that you did not link them
together (the 2/2 patch should References: the 1/2 patch). Better would have
been to maintain a cover letter and have both the 1/1 and 1/2 patch reference
that, just like you did in the "v1":
https://msgid.link/20241010175102.207324-1-jtornosm@redhat.com

Can you submit a v4 that follows that original pattern?

/jeff

Re: [PATCH v3 1/2] wifi: ath12k: fix crash when unbinding

[Jose Ignacio Tornos Martinez]

Hello Jeff,

> Your v3 patches look ok to me, however they are not showing up in Patchwork so
> I cannot act upon them. I suspect the issue is that you did not link them
> together (the 2/2 patch should References: the 1/2 patch). Better would have
> been to maintain a cover letter and have both the 1/1 and 1/2 patch reference
> that, just like you did in the "v1":
> https://msgid.link/20241010175102.207324-1-jtornosm@redhat.com
>
> Can you submit a v4 that follows that original pattern?
Sure, I will do as you say.

Thanks

Best regards
José Ignacio