From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B55B430B53A for ; Fri, 7 Aug 2026 01:47:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786067265; cv=none; b=MUbtvFo8/okZ8iHoEuuTlHU+YzrL69YIjVt1bxSoKMUlR55FzH0nF7sIhymc3Z0BGXv3Hy3CJ1ANhUClp8kyBuEPRIZ8IyJBsMoVph34NB2ootRxiCVmiSwn+Kfd+GK+69G09rs9qDaXk4LNO5iUQf2OB9DPqwZtLbi4VJ7ldtc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786067265; c=relaxed/simple; bh=klrxJKPs/SxSqdEiDtHEjI9ihnBPB3tTRXMGfG6Qms4=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=HwgvUHYXXMItZiIEmrze7RyAEbWUsyr1mXQS/Am4vBWz6DxDAB0FTOYeu2O9iSTpRY6H3t9Y5132vX4zW5V2VkJCqgW96CXVWUtbPhvx/D5wnaI6C1Tx7Rm3ciTQq2BpCvZ6UKxPbaAJ4KymZc+7QnHvPQkbYpjl0XGz92mMuYc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=DdEyf+vu; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=L/yhpDL8; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="DdEyf+vu"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="L/yhpDL8" Received: from pps.filterd (m0279865.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6770GfwC4063303 for ; Fri, 7 Aug 2026 01:47:41 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= T4yQd5VpQTZvFK02L358x4zxAu2+dKl10X0+R1gySgk=; b=DdEyf+vuBXbVuEks WrN++mMFH9m43FY2Z9c0V6+32xm0btAXC52gubLs9vjgRg4Ww4mO4k4TDYjQio5o pNmLLBlaF0rPnGGzYE9WXuds/rJNplbbvPrSumiUY52QqK1m+HeHCdIxt3Bq26HJ ZBS/R5ksobke/eHArFA6doyyDuV4mEgdWTLagqp1vZjGN5ZJXpAYgf58xP7WoR77 rQWLinK6UJ7QZvIaOffLWHgATROVpGHXs4peIgw1Z1lrWG8DBXBhzWXPlgZ69mal x7PSp2PRHCQzEDuZih0e5LX6y+XQZBJJTW60TgbS0rVbo0AWw3RwT/vFmX5kdsMC AAqVeA== Received: from mail-pj1-f71.google.com (mail-pj1-f71.google.com [209.85.216.71]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fvy6h9kek-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 07 Aug 2026 01:47:41 +0000 (GMT) Received: by mail-pj1-f71.google.com with SMTP id 98e67ed59e1d1-38dbf293831so5773403a91.3 for ; Thu, 06 Aug 2026 18:47:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1786067261; x=1786672061; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:from:to:cc:subject:date:message-id:reply-to :content-type; bh=T4yQd5VpQTZvFK02L358x4zxAu2+dKl10X0+R1gySgk=; b=L/yhpDL87CaiFLBzZ7MXHvJLsPmKpLwLcRm0s9P8KxiyLcjsIsj3kwP+QMhEM9Wz4w Dj4yn9OtgvAqBCq2EOJ3YM5OcSNSL4sPJLEeWbD7YP2PR7aFAz3k9fe4+aA+jM2eTwRh /AFrkKRkUUWBuGBXtS76NYRX9uWe0pPlHTfW9oHArVbJ/MK5FpTOdowR+D5YMg+8s+58 GV/OofjRwoxWhCvdzZOUpIlWtgY+xBWsWYkmVxYfB6YiLJn47JcWnuRGWblG1N4E+O59 gDRnooRnoHl3vtmNcvn60HgTRZk92qB6U9q2Hx02A7RN1T49w7rVkx+3SOE3t2eZFh7s lJsQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786067261; x=1786672061; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=T4yQd5VpQTZvFK02L358x4zxAu2+dKl10X0+R1gySgk=; b=faUByR6Zb1QbLKyPMfcWiw0qVb7/PnZDVEM5vjI+5OeRjUY4pYqvOASI+Oa22VKjtG GfRrsaOdDbUC6aYtvdwAoaDmf7oBvHt2NBk15uUVT6+57rlxXhAAhIikOWUYuVTpv+bP O7FhF5AXpBA8oda3m3COeCpwQSe0cfkAqhjEbraHtiiV8mO3Tl6t1JBb27F/fWjAWbK5 hIDL6GqP6AmrRsP6AH6IXO0r6kLKxE/6nJrLu2jic058Iquh+2C2A7M5oigpP3DaBJ7D 7Cqet3Pm6cFWnz2lbckgZcJOFNtVV2ngDb8kzbrc7jzgpqrHZf1w9LCKiPQBFRRIyEbI 2+6A== X-Forwarded-Encrypted: i=1; AHgh+RptrdbA71s1QkNbxObNerrZzCSOmUHBoIQ6hQTEmv86AHK812Qt9zRBk2Rvh0Qg78oY6jW9p+ngl+5jYMk=@vger.kernel.org X-Gm-Message-State: AOJu0Yxr9WK/qL6O6G+sSLvIYTwtPAk+Pk4J4pwQ0WY0/5vUymUgE8iu iRDHuYm/W7JPPQaH4HSnGLN4ZnBzPc7Ih03grGVhOP+e0aXIOwRzDENw1vnBHZQ30mJZueELiQu TIJsOqH+3FhBACH9XPXH8dNtFJBJgwNbgCgtP4QAtrIiL8CQMxGlY8spR0D5D0VBcYrU= X-Gm-Gg: AR+sD12faQuMn+iK6aNAXq6Ddb5QPWgF/NdPOWYTh/9OHKt+qwjDJ4qfZaKBTNq+tuW HtdJ9pexEA0e8mcpcQ9jwrbd6dhiQFHDCK4W3UT8aufaifR+vH+9GZfnheEPWLVb+qHjAKLYul4 oWCfZDZmb0ul+1EGaT93dz4CnDJVy1A1Q0OrAKCZ+VA4ULcI11X1vLJEdhzcVV8ZQMh99F9Zd34 CenOQPyzEF0b+FbTuvSsBs5aRSIROuzQm18kbjXVTjZgi5aSE/py7O/SLTUXfWziabQYBOQkqy6 HWYom+qyPn2HRvrBubYI9NmIG89FVyH9HfeVYVuPRA8L7zfFeu5uT4KkAL12UcdiGcwxUpzVJxC 9W1DMBGHSegA+1EiE59lj1bqJAVCEaURWeeAw9uKYysmNMU7kbBPpA6vhDVQ0 X-Received: by 2002:a17:90b:134f:b0:38e:488f:7068 with SMTP id 98e67ed59e1d1-39261f729d5mr365768a91.2.1786067260873; Thu, 06 Aug 2026 18:47:40 -0700 (PDT) X-Received: by 2002:a17:90b:134f:b0:38e:488f:7068 with SMTP id 98e67ed59e1d1-39261f729d5mr365726a91.2.1786067260421; Thu, 06 Aug 2026 18:47:40 -0700 (PDT) Received: from [192.168.1.20] (103.sub-97-215-187.myvzw.com. [97.215.187.103]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-315bec5aac2sm1064869eec.30.2026.08.06.18.47.39 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 06 Aug 2026 18:47:39 -0700 (PDT) Message-ID: <6a9196e8-2e2f-43f8-9665-6ebb82b95951@oss.qualcomm.com> Date: Thu, 6 Aug 2026 18:47:38 -0700 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] wifi: ath12k: fix channel list double-free on error paths To: Linkai Gong , Jeff Johnson Cc: Vasanthakumar Thiagarajan , Rameshkumar Sundaram , linux-wireless@vger.kernel.org, ath12k@lists.infradead.org, linux-kernel@vger.kernel.org References: <20260731093816.1771338-1-gonglinkai@kylinos.cn> Content-Language: en-US From: Jeff Johnson In-Reply-To: <20260731093816.1771338-1-gonglinkai@kylinos.cn> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Authority-Analysis: v=2.4 cv=G60s1dk5 c=1 sm=1 tr=0 ts=6a75393d cx=c_pps a=UNFcQwm+pnOIJct1K4W+Mw==:117 a=UaEkX0D7FlC0tWE/LoNF7Q==:17 a=IkcTkHD0fZMA:10 a=Sv0fKeRqtYgA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=Um2Pa8k9VHT-vaBCBUpS:22 a=VwQbUJbxAAAA:8 a=2tX9H4ud-KebakibVqoA:9 a=QEXdDO2ut3YA:10 a=uKXjsCUrEbL0IQVhDsJ9:22 X-Proofpoint-GUID: GzGaIDu3UF7NMK-6HSCzn0mVYis0H6nd X-Proofpoint-ORIG-GUID: GzGaIDu3UF7NMK-6HSCzn0mVYis0H6nd X-Proofpoint-Spam-Info: AW1haW4tMjYwODA3MDAxMCBTYWx0ZWRfXw7j4f4+rm9ik FOW0ObfU7ItgRzyQ/Z9qs0KYKjzH976HtheVJScSVqKtATqcHsM6HPcAbgEGvI+Wq1zMWcJ3Zam bDkFoqUd19WxkdFKvMcYG+B/pEH9eBw= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODA3MDAxMCBTYWx0ZWRfX7u0ASJkdnlKA QRGyM70NIvVt5XrgfBMYP0JtbNDK2a6odr2n6LeLjEeGUNXCTa6GlzZxD903P13+7syyy9QVlLy QT770i9XweY/NXA4DJx43fCK/yfd8zAi99iQsqyTH+V7+j+h8lGmI8PgQQiMJky2iQtuxZ9I/3i mDMMnsmGhqXzfOyYzCvz5imu63xtv21IhA4I4uDnARoWcrW+HbTf4gB6wl2F/9Q1H6Vg3ZG57KT d8YiBS6ktj4W5sjdbsp6UyQJ+8EfPXTbNJiwq3livVU8Ew7T0Yv3PrpS26iG+ZkGu1n7A0mcWgZ 5/s+JYP9sh4XPvtfvCia4z5RDz5VOMHXGMKGOoUf7eRNXH2Ia3Efjs9TcZmaFg+MwIO/JC8q7Cs w/ptbhOsisKps5V1DBsRnA8XSiu4+LaJWlAMlmal7Sm/xn78rA2gbLea6oBRXKxPGjwpFyJf56c zizgk2E0btl0HVEHSzw== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-07_01,2026-08-06_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 lowpriorityscore=0 priorityscore=1501 bulkscore=0 adultscore=0 spamscore=0 clxscore=1015 phishscore=0 suspectscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608070010 On 7/31/2026 2:38 AM, Linkai Gong wrote: > ath12k_mac_setup_channels_rates() frees band channel arrays on failure > but either leaves the pointers non-NULL or clears the wrong band. Later > ath12k_mac_cleanup_unregister() frees the same pointers again. > > Clear the correct sbands[].channels pointers after kfree(), including > a copy-paste bug that nulled 2 GHz after freeing 6 GHz channels. https://wireless.docs.kernel.org/en/latest/en/users/drivers/ath12k/submittingpatches.html#tested-on-tag Tested-on: tag missing. How was this tested? > > Fixes: acc152f9be20 ("wifi: ath12k: combine channel list for split-phy devices in single-wiphy") > Signed-off-by: Linkai Gong > --- > drivers/net/wireless/ath/ath12k/mac.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c > index a0928890671a..5468a8d2d5d5 100644 > --- a/drivers/net/wireless/ath/ath12k/mac.c > +++ b/drivers/net/wireless/ath/ath12k/mac.c > @@ -14275,6 +14275,7 @@ static int ath12k_mac_setup_channels_rates(struct ath12k *ar, > sizeof(ath12k_6ghz_channels), GFP_KERNEL); > if (!channels) { > kfree(ar->mac.sbands[NL80211_BAND_2GHZ].channels); > + ar->mac.sbands[NL80211_BAND_2GHZ].channels = NULL; > return -ENOMEM; > } > > @@ -14325,7 +14326,9 @@ static int ath12k_mac_setup_channels_rates(struct ath12k *ar, > GFP_KERNEL); > if (!channels) { > kfree(ar->mac.sbands[NL80211_BAND_2GHZ].channels); > + ar->mac.sbands[NL80211_BAND_2GHZ].channels = NULL; > kfree(ar->mac.sbands[NL80211_BAND_6GHZ].channels); > + ar->mac.sbands[NL80211_BAND_6GHZ].channels = NULL; > return -ENOMEM; > } > > @@ -14365,7 +14368,7 @@ static int ath12k_mac_setup_channels_rates(struct ath12k *ar, > kfree(ar->mac.sbands[NL80211_BAND_2GHZ].channels); > ar->mac.sbands[NL80211_BAND_2GHZ].channels = NULL; > kfree(ar->mac.sbands[NL80211_BAND_6GHZ].channels); > - ar->mac.sbands[NL80211_BAND_2GHZ].channels = NULL; > + ar->mac.sbands[NL80211_BAND_6GHZ].channels = NULL; > kfree(channels); > band->channels = NULL; > return ret;