From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 084063AE6F4 for ; Fri, 31 Jul 2026 08:16:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785485796; cv=none; b=lLJqFRTvE52MV2vFgRRWfbQ5jGPlUZHaMpSt2B9cWcKMcffwERyOOikuWZuzXynqP+ApCGIxAulU3QzBlFwmv72/2/zW0KIuVS4I5/KSIrRk9K35jTdW2OR3q5saS3Kk833j5nBWt6zRR6e6ELBIzsgezf6zndS9Xm2+47yOQAQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785485796; c=relaxed/simple; bh=kpANFUzyRHmrHyDZPYfp7w54Xo1u200jNVNuzvKz07c=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=qDKGxhxFmybjYP/QMwwwmeeJNCD5MXYtnwYeJEDySDOyz8MqYXLj+HFV2s+mNu/fBBPdlSKowBOnANYTLmnSigXpSMaEc77t+6zqHCg/ZGb8PjLjlUEL446pd5fnXKtI3Tbhqjih95ojsA+efmCY6P5A0VD41WYN3mSmlxpNj1g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=azIvyioV; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=S/jJQjey; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="azIvyioV"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="S/jJQjey" Received: from pps.filterd (m0279871.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66V7xEiV3694676 for ; Fri, 31 Jul 2026 08:16:33 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= gwN4m3GZszv7Lk8bq89AA1n4J6jRQ5eRfOtjYkSzynw=; b=azIvyioV22BMdMnZ uSu53KqY6KaVNQbchd+zdzT0W7jWelZDKSWIjg2DwPv6j7nXblpUA3O4Hcimh3aZ CmanFPq7ql0bm6gydB/BXYmd9tZ4g4kEfWOsXdqvelwMPzOK+n2UNfcme/YRJnPh iy0C/5J0IiWEuiTT6cRpHQqOzedSOnKgTj/gj+4NSmijlDzd24EtWQgMTBEz8FQ7 zMg31bS+eirtgjLVtqZ5UUmXxkpVehllIDlPFKntd9AF42ToPn/CEIBbiGHRQw9B +MS8eBa5DmbN+8NV+eWAchHrD5Gm0MouFVo/gz8uCT4kuUlUz0CwmWdezYxVc9Er 7wXtIg== Received: from mail-pf1-f198.google.com (mail-pf1-f198.google.com [209.85.210.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4frqssr1y4-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 31 Jul 2026 08:16:33 +0000 (GMT) Received: by mail-pf1-f198.google.com with SMTP id d2e1a72fcca58-8486ffba174so1467003b3a.1 for ; Fri, 31 Jul 2026 01:16:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1785485787; x=1786090587; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:content-language :from:references:cc:to:subject:user-agent:mime-version:date :message-id:from:to:cc:subject:date:message-id:reply-to:content-type; bh=gwN4m3GZszv7Lk8bq89AA1n4J6jRQ5eRfOtjYkSzynw=; b=S/jJQjeyezQHJ/iOtorEHdZUL6ng1aFa7nFf9qgU2Fmb2FLatW5ee64y/RCKclxTpv oejIvlcenYzWGbqt416RYdS5Ob4K1ybKH8ygExVGNS612kxHNLHGat7KAMBvhqjG9UGn OFwknfZMYANfwULPpqTorPKQPu6e7s/cRRPTMDx9auQhyyQTextMDv8hcGUmQY37Sp9a 4265260T82cwc0lDHNBgxRVF7P2Zgzh+NHWdBl7elZZ1/9RM/Hcw7hi62NuGc6GYz2NT iJs3vU+tbtnoCLvWRJH9/PGt+m7AAzcvIjhP7At1jcB9xQdHMJstmCkLCT7WeUqapAnD GVHQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785485787; x=1786090587; h=content-transfer-encoding:content-type:in-reply-to:content-language :from:references:cc:to:subject:user-agent:mime-version:date :message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=gwN4m3GZszv7Lk8bq89AA1n4J6jRQ5eRfOtjYkSzynw=; b=CJKhGloiIT0YZacqgeLnhzL4s2FFNXpigUVItgvC/Hfy4k9oCtLuBRm3kXCcBDXw0U n3RCrNJYRSwbAdwskB1ez2/lalX3VKVAwleoyW8i4tHvsDMH9oBw2r+BQFRLVN5SYvce b7zSo7m9WxRGHe+mhK15f+ucf6xKP9BBvjZQ60NwMBY5prGCAaWiEzeLN4iSHFo1vxan TNc+XgNV0YhDfkBYcf6d84+vKfmMPYiUCQUuZVSBhfBtJVSb4Ge6fWmw+e8+dCHcJG+M cTMF1DEXuahTVsP8o2rdoTA5Og08e8EXvX2l8ZeYwV39G6o/pMlQ8AKq78npaPFkKHTr 8vPA== X-Forwarded-Encrypted: i=1; AHgh+RomBzZ+NoH3HURZZIOohT0iYVo6C6RBiWAw28EhLDyFglcQh2rhLAS7BJJCw1LYWeWe1wOT1DE8b7bMMq8=@vger.kernel.org X-Gm-Message-State: AOJu0YzOgt//xp5f3cY0oPxH/qYkqQmDOJRAmfJiwSbl9Uhx6QV8LGCW 8nwBakQtyJC8cqFn7UjB+BjwtfSfAOaIHq5VDpg36jENYtuh+g+s/dO7NcqWKEipvuxlX6pseFQ 6gGt81FF9IWwDKjp62JSRYaBIDzp6E7QCvjKfvu+Jf4vaUMHnoQvod9c/cqyekRO/Tc98Oo/eZy A= X-Gm-Gg: AR+sD13sYcjACnhc1j690uKq6rLEnf7Vud27VL8tJZwPMzuBQgStY2tL9ao0xWK3yS6 BToYN6qD2hDYTicAshXDl2KCpV5LGQ1hea0AMEuvh1L4Sy9GEHNaW6rB9hflcE7RT55nThRgVkd iPDJngFenZqrusRNE8eVQer9Yl7/f4rN0SFl+0AfHO2xxMhQij75eV+q0Rm0QM4FbOhTuXOQmFG pZ4BFBGTTrdwG6EplBrXC6kygdl6lYyt5+hrd/fGd1og/Jt/WTmEIXPF/Y0uOJsCWRMN0RR19Ev 6kEyv5TdlEGztoUJFiQjtF2Le0HKtHujO9ILTKFTkXtKFKqhlKfAMdZ3HKAnlj3CzpYFT/wY6rO rGAkhZPwbN/Q4G+yvs26pir5Nqm6vkn0KeeBfXPjpNbrBbYwxgMJ7oyZzSAdaM6cUinj2jQ0zLw == X-Received: by 2002:a05:6a00:4285:b0:847:95a6:eb74 with SMTP id d2e1a72fcca58-84ed6d227e1mr908915b3a.23.1785485787275; Fri, 31 Jul 2026 01:16:27 -0700 (PDT) X-Received: by 2002:a05:6a00:4285:b0:847:95a6:eb74 with SMTP id d2e1a72fcca58-84ed6d227e1mr908888b3a.23.1785485786626; Fri, 31 Jul 2026 01:16:26 -0700 (PDT) Received: from [10.133.33.123] (tpe-colo-wan-fw-bordernet.qualcomm.com. [103.229.16.4]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84edbe564b3sm140033b3a.14.2026.07.31.01.16.23 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 31 Jul 2026 01:16:26 -0700 (PDT) Message-ID: <81041a09-bffe-426f-a087-f6e48de93531@oss.qualcomm.com> Date: Fri, 31 Jul 2026 16:16:21 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 2/5] wifi: ath12k: prevent scan during firmware recovery To: Jose Ignacio Tornos Martinez , jjohnson@kernel.org Cc: ath11k@lists.infradead.org, ath12k@lists.infradead.org, linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org References: <20260727162748.963275-1-jtornosm@redhat.com> <20260727162748.963275-3-jtornosm@redhat.com> From: Baochen Qiang Content-Language: en-US In-Reply-To: <20260727162748.963275-3-jtornosm@redhat.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Proofpoint-Spam-Info: AW1haW4tMjYwNzMxMDA1OCBTYWx0ZWRfX+kwoJgDz5rbz a9G5Ux1eMGGn0nd0hSCurotTU7IRTafBCKhViR66Vz9xWnuAUpDARM9iuEdStcaJrHoOLmwKOgf 9vhZKud3QiaQRwAlDg0SsQ/ZGk3Y2xg= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzMxMDA1OCBTYWx0ZWRfXyJBzgHZU3rpb U/QvfT872/19+i/VD1zmN+n3a7eDemomjsCb/7pv2wRFCqE2pXQzHCVcnyL482St6i3hM0UflHW yduES3a0Ipnu+HMvsGxiswKJP8KBMRukp8ECHOvhHdZR4EqWJqpuEDhH13tRBAixsd83t+n989R gshhE6A251/sHjDPVe97e+aoAY6gyLA3/QWxVOfM6YglkaEGDEoVF4YUDqFi4E/1WWItQH4Y2mI cD5hpSu75crR4qOj8aVhXIAtHVNH4KW87jsu9IcVvijnTiuZsVAYTEhiWhCIZPuc2u35KQRQIwT 5V/O3Lk4Cu1WJni4tED98b+HqJEskSbJdmqMPwSwy9PHtHcI7b1PlCsaCrzFF+OibbDr1ZuLYbV IES9pmOIcB77ONf8kRrtnQ7/dVU8B2lBEXnSJsnQDPSHKSQWCBLezbU7NuLYKk/qwKmVHRnUS9w yndOhbllUq0/RNbvHUA== X-Proofpoint-GUID: s0sJYhmMptmQo1PHSYXbFhEkNmfidEO8 X-Authority-Analysis: v=2.4 cv=QMpYgALL c=1 sm=1 tr=0 ts=6a6c59e1 cx=c_pps a=m5Vt/hrsBiPMCU0y4gIsQw==:117 a=nuhDOHQX5FNHPW3J6Bj6AA==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=3WHJM1ZQz_JShphwDgj5:22 a=20KFwNOVAAAA:8 a=Ck2z4BDfFmx1ngdb9lwA:9 a=QEXdDO2ut3YA:10 a=IoOABgeZipijB_acs4fv:22 X-Proofpoint-ORIG-GUID: s0sJYhmMptmQo1PHSYXbFhEkNmfidEO8 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-31_03,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 phishscore=0 priorityscore=1501 spamscore=0 impostorscore=0 malwarescore=0 bulkscore=0 lowpriorityscore=0 adultscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607310058 On 7/28/2026 12:27 AM, Jose Ignacio Tornos Martinez wrote: > When firmware crashes while wpa_supplicant has an active connection, > wpa_supplicant may immediately attempt a scan via nl80211 while the > firmware is still powering on through MHI. ath12k_mac_op_hw_scan() > proceeds without checking the recovery state, accessing partially > initialized radio structures which leads to a NULL pointer dereference: do we know the exact structure/pointer that is causing this issue? just want to know the details of the crash. > > BUG: unable to handle page fault for address: 0000000000001508 > RIP: ath12k_mac_op_hw_scan+0x148/0x2b0 [ath12k] > Call Trace: > drv_hw_scan+0x88/0x140 [mac80211] > __ieee80211_start_scan+0x2bc/0x6b0 [mac80211] > nl80211_trigger_scan+0x54a/0x9f0 [cfg80211] > > Fix by checking ATH12K_FLAG_RECOVERY at the start of > ath12k_mac_op_hw_scan() and returning -EBUSY. mac80211 will retry the > scan after the recovery completes. > > Tested on WCN7850 with MLO (Wi-Fi 7). > > Signed-off-by: Jose Ignacio Tornos Martinez > --- > drivers/net/wireless/ath/ath12k/mac.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c > index f33976fc1233..924c3c21ca78 100644 > --- a/drivers/net/wireless/ath/ath12k/mac.c > +++ b/drivers/net/wireless/ath/ath12k/mac.c > @@ -5707,6 +5707,9 @@ int ath12k_mac_op_hw_scan(struct ieee80211_hw *hw, > > lockdep_assert_wiphy(hw->wiphy); > > + if (test_bit(ATH12K_FLAG_RECOVERY, &ah->radio[0].ab->dev_flags)) > + return -EBUSY; > + > chan_list = kzalloc_objs(*chan_list, hw_req->req.n_channels); > if (!chan_list) > return -ENOMEM;