[PATCH 6.14.y v2 1/2] Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process"

[PATCH 6.14.y v2 1/2] Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process"

[Alexander Tsoy]

This reverts commit 0c1015493f0e3979bcbd3a12ebc0977578c87f21 as it was
backported incorrectly.
A subsequent commit will re-backport the original patch.

Signed-off-by: Alexander Tsoy <alexander@tsoy.me>
---
 drivers/net/wireless/ath/ath12k/dp_mon.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c
index 0b089389087d..8005d30a4dbe 100644
--- a/drivers/net/wireless/ath/ath12k/dp_mon.c
+++ b/drivers/net/wireless/ath/ath12k/dp_mon.c
@@ -2473,7 +2473,7 @@ int ath12k_dp_mon_rx_process_stats(struct ath12k *ar, int mac_id,
 		dest_idx = 0;
 move_next:
 		ath12k_dp_mon_buf_replenish(ab, buf_ring, 1);
-		ath12k_hal_srng_dst_get_next_entry(ab, srng);
+		ath12k_hal_srng_src_get_next_entry(ab, srng);
 		num_buffs_reaped++;
 	}
 
-- 
2.49.0

[PATCH 6.14.y v2 2/2] wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process

[Alexander Tsoy]

From: P Praneesh <quic_ppranees@quicinc.com>

[ Upstream commit 63fdc4509bcf483e79548de6bc08bf3c8e504bb3 ]

Currently, ath12k_dp_mon_srng_process uses ath12k_hal_srng_src_get_next_entry
to fetch the next entry from the destination ring. This is incorrect because
ath12k_hal_srng_src_get_next_entry is intended for source rings, not destination
rings. This leads to invalid entry fetches, causing potential data corruption or
crashes due to accessing incorrect memory locations. This happens because the
source ring and destination ring have different handling mechanisms and using
the wrong function results in incorrect pointer arithmetic and ring management.

To fix this issue, replace the call to ath12k_hal_srng_src_get_next_entry with
ath12k_hal_srng_dst_get_next_entry in ath12k_dp_mon_srng_process. This ensures
that the correct function is used for fetching entries from the destination
ring, preventing invalid memory accesses.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3

Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
Link: https://patch.msgid.link/20241223060132.3506372-7-quic_ppranees@quicinc.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath12k/dp_mon.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c
index 8005d30a4dbe..b952e79179d0 100644
--- a/drivers/net/wireless/ath/ath12k/dp_mon.c
+++ b/drivers/net/wireless/ath/ath12k/dp_mon.c
@@ -2054,7 +2054,7 @@ int ath12k_dp_mon_srng_process(struct ath12k *ar, int mac_id, int *budget,
 		dest_idx = 0;
 move_next:
 		ath12k_dp_mon_buf_replenish(ab, buf_ring, 1);
-		ath12k_hal_srng_src_get_next_entry(ab, srng);
+		ath12k_hal_srng_dst_get_next_entry(ab, srng);
 		num_buffs_reaped++;
 	}
 
-- 
2.49.0

Re: [PATCH 6.14.y v2 2/2] wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process

[Greg Kroah-Hartman]

On Tue, Apr 22, 2025 at 03:02:37PM +0300, Alexander Tsoy wrote:
> From: P Praneesh <quic_ppranees@quicinc.com>
> 
> [ Upstream commit 63fdc4509bcf483e79548de6bc08bf3c8e504bb3 ]
> 
> Currently, ath12k_dp_mon_srng_process uses ath12k_hal_srng_src_get_next_entry
> to fetch the next entry from the destination ring. This is incorrect because
> ath12k_hal_srng_src_get_next_entry is intended for source rings, not destination
> rings. This leads to invalid entry fetches, causing potential data corruption or
> crashes due to accessing incorrect memory locations. This happens because the
> source ring and destination ring have different handling mechanisms and using
> the wrong function results in incorrect pointer arithmetic and ring management.
> 
> To fix this issue, replace the call to ath12k_hal_srng_src_get_next_entry with
> ath12k_hal_srng_dst_get_next_entry in ath12k_dp_mon_srng_process. This ensures
> that the correct function is used for fetching entries from the destination
> ring, preventing invalid memory accesses.
> 
> Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
> Tested-on: WCN7850 hw2.0 WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
> 
> Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
> Link: https://patch.msgid.link/20241223060132.3506372-7-quic_ppranees@quicinc.com
> Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>

You didn't sign off on this :(

And I don't think Sasha did either.

Be careful with these types of attributes please.

thanks,

greg k-h

Patch "Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process"" has been added to the 6.14-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process"

to the 6.14-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     revert-wifi-ath12k-fix-invalid-entry-fetch-in-ath12k_dp_mon_srng_process.patch
and it can be found in the queue-6.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


From alexander@tsoy.me  Tue Apr 22 15:03:50 2025
From: Alexander Tsoy <alexander@tsoy.me>
Date: Tue, 22 Apr 2025 15:02:36 +0300
Subject: Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process"
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org
Cc: patches@lists.linux.dev, P Praneesh <quic_ppranees@quicinc.com>, Jeff Johnson <jeff.johnson@oss.qualcomm.com>, Sasha Levin <sashal@kernel.org>
Message-ID: <20250422120237.228960-1-alexander@tsoy.me>

From: Alexander Tsoy <alexander@tsoy.me>

This reverts commit 0c1015493f0e3979bcbd3a12ebc0977578c87f21 which is
commit 63fdc4509bcf483e79548de6bc08bf3c8e504bb3 upstream as it was
backported incorrectly.

A subsequent commit will re-backport the original patch.

Signed-off-by: Alexander Tsoy <alexander@tsoy.me>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/ath12k/dp_mon.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/ath/ath12k/dp_mon.c
+++ b/drivers/net/wireless/ath/ath12k/dp_mon.c
@@ -2473,7 +2473,7 @@ int ath12k_dp_mon_rx_process_stats(struc
 		dest_idx = 0;
 move_next:
 		ath12k_dp_mon_buf_replenish(ab, buf_ring, 1);
-		ath12k_hal_srng_dst_get_next_entry(ab, srng);
+		ath12k_hal_srng_src_get_next_entry(ab, srng);
 		num_buffs_reaped++;
 	}
 


Patches currently in stable-queue which might be from alexander@tsoy.me are

queue-6.14/revert-wifi-ath12k-fix-invalid-entry-fetch-in-ath12k_dp_mon_srng_process.patch