CVE-2026-90348: wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump

CVE-2026-90348: wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump

On WCN3990/SNOC the MSA region is mapped with devm_memremap(MEMREMAP_WT).
On arm64 such a mapping is not Normal-cacheable, so unaligned accesses to
it are not permitted. ath10k_msa_dump_memory() copies the region with a
plain memcpy(), whose optimized __pi_memcpy_generic implementation issues
wide/unaligned loads. This triggers an alignment fault (FSC=0x21) Oops in
ath10k_snoc_fw_crashed_dump() while collecting the devcoredump:

  Unable to handle kernel paging request ... FSC=0x21: alignment fault
  pc : __pi_memcpy_generic
  lr : ath10k_snoc_fw_crashed_dump [ath10k_snoc]

The Oops both leaves the firmware RAM dump buffer zeroed (no dump is
captured) and crashes the kernel, which in turn breaks modem SSR
recovery.

Use memcpy_fromio(), which only performs accesses that are valid for such
a device-memory mapping. The generic memcpy_fromio() implementation aligns
the source before issuing word-sized reads and stores the destination with
put_unaligned(), so it is also safe for the coherent DMA allocation used on
the non-reserved-memory path. ath11k and ath12k use the same pattern
when copying target memory into crash dumps, so call it unconditionally
here too.
The MEMREMAP_WT pointer is a plain void *, so an explicit __iomem cast is
needed; use __force to keep sparse happy.

Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.3.7.c5-00107-QCAHLSWMTPL-1

The Linux kernel CVE team has assigned CVE-2026-90348 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.5 with commit 3f14b73c38431a6a1ed24de568e18ed89b7082e2 and fixed in 5.10.270 with commit e5bc3658da9c8a535e3fa5c0c875b2a456954e81
	Issue introduced in 5.5 with commit 3f14b73c38431a6a1ed24de568e18ed89b7082e2 and fixed in 5.15.221 with commit fed1f662c9f9fd19eeab6c01966b7b5a33804420
	Issue introduced in 5.5 with commit 3f14b73c38431a6a1ed24de568e18ed89b7082e2 and fixed in 6.1.188 with commit 838cab267ce9a975776e022f25094f8cbe1625d2
	Issue introduced in 5.5 with commit 3f14b73c38431a6a1ed24de568e18ed89b7082e2 and fixed in 6.6.157 with commit eb946595a58decdb4cab1b5f3c972ae66f41f1c8
	Issue introduced in 5.5 with commit 3f14b73c38431a6a1ed24de568e18ed89b7082e2 and fixed in 6.12.110 with commit 152e894e90716163c646d70f86b3afeb70442783
	Issue introduced in 5.5 with commit 3f14b73c38431a6a1ed24de568e18ed89b7082e2 and fixed in 6.18.52 with commit 7039825a7479df637c4f5d546cb0e1cec18cd8e1
	Issue introduced in 5.5 with commit 3f14b73c38431a6a1ed24de568e18ed89b7082e2 and fixed in 7.2.6 with commit 045d1bfb72d2631ab9ec74afa491aa788ebb57aa
	Issue introduced in 5.5 with commit 3f14b73c38431a6a1ed24de568e18ed89b7082e2 and fixed in 7.3-rc1 with commit 4f25071afe9218aaae1c63fbf75e229aa6405319

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-90348
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/wireless/ath/ath10k/snoc.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/e5bc3658da9c8a535e3fa5c0c875b2a456954e81
	https://git.kernel.org/stable/c/fed1f662c9f9fd19eeab6c01966b7b5a33804420
	https://git.kernel.org/stable/c/838cab267ce9a975776e022f25094f8cbe1625d2
	https://git.kernel.org/stable/c/eb946595a58decdb4cab1b5f3c972ae66f41f1c8
	https://git.kernel.org/stable/c/152e894e90716163c646d70f86b3afeb70442783
	https://git.kernel.org/stable/c/7039825a7479df637c4f5d546cb0e1cec18cd8e1
	https://git.kernel.org/stable/c/045d1bfb72d2631ab9ec74afa491aa788ebb57aa
	https://git.kernel.org/stable/c/4f25071afe9218aaae1c63fbf75e229aa6405319