From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 917E93B3C08 for ; Mon, 10 Aug 2026 10:14:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786356896; cv=none; b=Woc434UnuV5W29aEmlhqn4KM3ODx+PgyudNGrWCSHBiZ8iHDkNPEePU9qDSe2err0JqrFNckiAp5TOODqX11QVxWx3jSqZq2rs+yWDUOYE7fT0oNyU5Rs/dYnsQxiP3lv9vW8YrN1eplMiE8+ktkITDe2IES2NGKJWd7y7Pcowk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786356896; c=relaxed/simple; bh=wlKu7Zdj316j95U1Ln5YkZ//0Gh/A44GvBhrF1dFRiM=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=pBYpYyFKU4yVPWW66dSy0SLAgJmEfx2s4+1hIigK8YAgmqielbivMeVf7rlrQ1BJPKP6x0exIyWfWMDL+239Zu/SwKXpsCEYOjedbnBf56KXYk6dkRouNdyYPLQWeT5cPKw/lgd8npDYocPd0073O8XnOH9pfd1DgUcdLC+6v4w= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=RXVe7XjT; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=PyrQsUKf; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="RXVe7XjT"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="PyrQsUKf" Received: from pps.filterd (m0279869.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67AA07B1009810 for ; Mon, 10 Aug 2026 10:14:53 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= +ndecEpN+n0XznSr43JboGJpcwJUV9bTfXnA5oOtPSY=; b=RXVe7XjTUaBgAQHL hi/tmi5wGaZsUzEmogZ5aYQzNlRGUz5RYuWydRzJDF7niW1PVB2XXioXy4YhzDsy 9+cJbvxnnLVm+KoRTA2r2wJwPeJVdesREIIg2OvZJkVWfphJOMT+PPqqRyHJnOC1 /+HOOHXIvkf+rtZki7PcLbbVAR7ApUFZGf1iPlf2BWTnXDx8dJdaODgYuX6Twmub XrF+GMStT8pPke7E/BlqMiOYnA+k0ESGQUhsfNBvk1lTsnpmm9HvZv1VM1me11oN Cc2T3Vv+L6ugVLOYhmO1aVfXjG+GH50c7NT4R8iP3GIIdpnW66ESGei7ADcaddVM 0xFtIA== Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fycger202-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Mon, 10 Aug 2026 10:14:53 +0000 (GMT) Received: by mail-pl1-f200.google.com with SMTP id d9443c01a7336-2d02df2bf09so26963685ad.0 for ; Mon, 10 Aug 2026 03:14:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1786356886; x=1786961686; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:content-language :from:references:cc:to:subject:user-agent:mime-version:date :message-id:from:to:cc:subject:date:message-id:reply-to:content-type; bh=+ndecEpN+n0XznSr43JboGJpcwJUV9bTfXnA5oOtPSY=; b=PyrQsUKf1ADLcs1KYHnUe+xEVVefzJ7zp/7fwNCorM9ftjsALs+wCIR1ubXqc9oo3J IWHbAinR+9AGakEnz/fQDxWHVKUkFslLhf+sR48kF93d5AAr5IzQ+G9X95FSs6B5hE7y euXSFIkfEtduiCXzvkUJW1DKDL2QcpdB2OzNcVzRl8mNAY91BblfYiHnpjIn4CBQOSR3 wnz3SAYdKUd/QAfowJ6gPYrt5+MpIaF8YI3x09PBXM38Bx6YbhjLot0L++7coesq9lig HKMO8XsGIzJlH3kWUjz6wYmTGc1Y0ofwxTmMbRhyh4yXdnWPWTje9BM6liKVBPld4gO0 cTwg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786356886; x=1786961686; h=content-transfer-encoding:content-type:in-reply-to:content-language :from:references:cc:to:subject:user-agent:mime-version:date :message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=+ndecEpN+n0XznSr43JboGJpcwJUV9bTfXnA5oOtPSY=; b=kLfR5K27GoVlobMA/LIyN5q4uT3Et65t/pwIfdpLSiU6EFRuArKchl87RVVtPbdsec jNHLt/j2lUnSVyIN/TVFOfygBkS7TuQkUpCFFFQdnQYlNft4tS2fEo3YBXHZqRr0Hae6 HUrV5TBcTzwTXKPzGk5PoM5uaS+NAh3hMzHdG9EXc2v2wpqHCJJBJbH7mBtXB8BNRZPP caoqO5XujQ2IyQwUmI4+i4FUp0VTmicL6WxQKIVtGZLtbSe0A/GL2LS0RFgid1yj/s4C K0aLG80ebS0GDejyOE1mkM80kMk82vLvupx5Xhn1FSU5qffHY79hHRtES0WQ3enhtkq1 yjOw== X-Forwarded-Encrypted: i=1; AHgh+Ron12FeSa0zOAU7NPSLgT7lMJROOHuMcPh+kfCqaalMycMTe2z3dSUsNC54NqoJvSl8vupkjC6TG1B/VGc=@vger.kernel.org X-Gm-Message-State: AOJu0YxO5WRj87Vzy29o6/wK5N/Yd3Tb2a7tATqqE/V1uchvon/WT2oP nrBuc4cgPalQ3e/mxq3O0zAu4EMMnlvPmq+FjWgndv/V5TRTMr1E2YBstt7WkdmSxn7O6ujTZBj jP/t+/ku6ApHd20Enf/xVIVQnsvKT8uq8OcNPFwyvjs1/JpZ7OPuojO8Hl9E4dZpXxTM= X-Gm-Gg: AR+sD11T/CTM9+96vhCxU+DkrNq8o72BXu8rdazWsDi0F7KtzvqA/2kcaHRsNlyKvYa BiVn89Z7dHwwk71srSXyK3nSVg/S/rRjZJnZfCSk5vhwiN0aADXK8Rr033lx3/KTNjSMUS1BD0A pMSN09i5HE1m6DFgZK4sUu5dz9z+KPz2dgTBPN2HGgdImtlghnOXy1/F8HTODaBM4Ap42iqGwWG OAB5/3T+TiDd9ZuY+lA6a/gjbeWPLJgTUg0kdeBkgwBB2OonTgcS4Zh2jqgnzyuBu9Z5szJHJSQ OEs4kWdoBxVqaf/5iqg7SBf/yurk3rFbaHymJ8XzoXUuh8ed7Rdnj72XiuLuMzQgtfIUIQupy79 MrEFo2+aAtW/nkhbkD+J5YLeY9Kgyijs/IAVYdxX8 X-Received: by 2002:a17:902:f60c:b0:2cc:6329:b7ba with SMTP id d9443c01a7336-2d0ca7835a7mr500883645ad.16.1786356886361; Mon, 10 Aug 2026 03:14:46 -0700 (PDT) X-Received: by 2002:a17:902:f60c:b0:2cc:6329:b7ba with SMTP id d9443c01a7336-2d0ca7835a7mr500883095ad.16.1786356885898; Mon, 10 Aug 2026 03:14:45 -0700 (PDT) Received: from [10.152.199.23] ([202.46.23.19]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-315be8d6074sm44784271eec.12.2026.08.10.03.14.43 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 10 Aug 2026 03:14:45 -0700 (PDT) Message-ID: <59d20ace-66cc-4a0c-a09a-e669becd2657@oss.qualcomm.com> Date: Mon, 10 Aug 2026 15:44:40 +0530 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] wifi: ath12k: fix channel list double-free on error paths To: Linkai Gong , Jeff Johnson Cc: Vasanthakumar Thiagarajan , linux-wireless@vger.kernel.org, ath12k@lists.infradead.org, linux-kernel@vger.kernel.org References: <20260731093816.1771338-1-gonglinkai@kylinos.cn> From: Rameshkumar Sundaram Content-Language: en-US In-Reply-To: <20260731093816.1771338-1-gonglinkai@kylinos.cn> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Proofpoint-ORIG-GUID: Qc_K1JgLvZ74oOuHYnp8E7WbtDi2PtjS X-Authority-Analysis: v=2.4 cv=R4cz39RX c=1 sm=1 tr=0 ts=6a79a49d cx=c_pps a=IZJwPbhc+fLeJZngyXXI0A==:117 a=j4ogTh8yFefVWWEFDRgCtg==:17 a=IkcTkHD0fZMA:10 a=Sv0fKeRqtYgA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=_glEPmIy2e8OvE2BGh3C:22 a=m_MqYSANrp1KMMaA_BEA:9 a=QEXdDO2ut3YA:10 a=uG9DUKGECoFWVXl0Dc02:22 X-Proofpoint-GUID: Qc_K1JgLvZ74oOuHYnp8E7WbtDi2PtjS X-Proofpoint-Spam-Info: AW1haW4tMjYwODEwMDA4OCBTYWx0ZWRfX/kP+bs7AKVLS lsbzT0zwTXq/vHx4AI7UKhneeK4kTv1DtqSL8BxtZ+80iKecC5EFmq90uq186r9tDcY39ue/Gbu NpvtuBB1Q3fwF3aXzqfk6y6s6bOl108= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODEwMDA4OCBTYWx0ZWRfX5f3178oou6cv 8SdZ05MH/HRwx+g3+OR2p4aRhqQq/FWZ9QeDJtUfxhGS1mp3qWW2ObDaGgBFN1fbdlooF+Ubw5k hs8QlSab8yi19SMjsy1deY+gDmjuMyv44QyEcvrMNc85Dac6DTTKTYuq3TwEe14cYItzculk+3r A1B/WetoMjElzvMBJKxOBvs9K9oU0ICE5Tu6T8ElVdgIQNvw+2cbz8uB6yxYyIv/ynMdHBYG4B4 hp1WIcp3tFyTw9Mzc2IcCyJvoBvigDiaohV2oYc7EG/Vn60MxavhZ3NpcSZSDUNABtdShX8KJ0m 3RZhPpTt8EzUoo9spPKQW9iGEeQqd8SEmlVpIL4yuHiwTR5XxgcovkGYuKnHFfpxV1SHdDGyWkf 5+jvZqLTUQHdS6cggQpPBBn6Rhk0Z/f1BbMsva2YAYLFVT63rDrnDtSEkrlcwvSBrjc0jciah40 V/ihODrzE/M3N1fRESQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-10_02,2026-08-07_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 adultscore=0 malwarescore=0 priorityscore=1501 bulkscore=0 suspectscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608100088 On 7/31/2026 3:08 PM, Linkai Gong wrote: > ath12k_mac_setup_channels_rates() frees band channel arrays on failure > but either leaves the pointers non-NULL or clears the wrong band. Later > ath12k_mac_cleanup_unregister() frees the same pointers again. > > Clear the correct sbands[].channels pointers after kfree(), including > a copy-paste bug that nulled 2 GHz after freeing 6 GHz channels. > > Fixes: acc152f9be20 ("wifi: ath12k: combine channel list for split-phy devices in single-wiphy") > Signed-off-by: Linkai Gong > --- > drivers/net/wireless/ath/ath12k/mac.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c > index a0928890671a..5468a8d2d5d5 100644 > --- a/drivers/net/wireless/ath/ath12k/mac.c > +++ b/drivers/net/wireless/ath/ath12k/mac.c > @@ -14275,6 +14275,7 @@ static int ath12k_mac_setup_channels_rates(struct ath12k *ar, > sizeof(ath12k_6ghz_channels), GFP_KERNEL); > if (!channels) { > kfree(ar->mac.sbands[NL80211_BAND_2GHZ].channels); > + ar->mac.sbands[NL80211_BAND_2GHZ].channels = NULL; > return -ENOMEM; > } > > @@ -14325,7 +14326,9 @@ static int ath12k_mac_setup_channels_rates(struct ath12k *ar, > GFP_KERNEL); > if (!channels) { > kfree(ar->mac.sbands[NL80211_BAND_2GHZ].channels); > + ar->mac.sbands[NL80211_BAND_2GHZ].channels = NULL; > kfree(ar->mac.sbands[NL80211_BAND_6GHZ].channels); > + ar->mac.sbands[NL80211_BAND_6GHZ].channels = NULL; > return -ENOMEM; > } > Above two hunks seem to fix older allocation-failure paths which already existed before acc152f9be20. In current history those lines blame back to d889913205cf ("wifi: ath12k: driver for Qualcomm IEEE 802.11ax devices"). So this probably should either be split into two fixes, or the commit message/Fixes tag should be adjusted. But unless there is another reachable path where these stale pointers are later freed or dereferenced, do we really need a Fixes tag here? > @@ -14365,7 +14368,7 @@ static int ath12k_mac_setup_channels_rates(struct ath12k *ar, > kfree(ar->mac.sbands[NL80211_BAND_2GHZ].channels); > ar->mac.sbands[NL80211_BAND_2GHZ].channels = NULL; > kfree(ar->mac.sbands[NL80211_BAND_6GHZ].channels); > - ar->mac.sbands[NL80211_BAND_2GHZ].channels = NULL; > + ar->mac.sbands[NL80211_BAND_6GHZ].channels = NULL; > kfree(channels); > band->channels = NULL; > return ret; -- Ramesh