From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1A975423782; Thu, 30 Jul 2026 15:33:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785425633; cv=none; b=cBaJSjMIGlvut5baqOcXNJpmR8G591lWkqwxxKYo1IxSuPU5x114X+qcpF5+EBrpekj6M6q3n/8sTWHIk3gCeQ4HvmCL4ENLz2ZP7iuIkZHH1sW2IuvItxZwqWsoZ/xpHHpJF5nROFJMY30Lg0uCzcNx0+dMqrmZSJzo3jlae/s= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785425633; c=relaxed/simple; bh=FPO23uFkByGDBX1UdK8uajgL8sReQDzuCsaGBM5SHhs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=NymWi99m5kxsJG1zWaLrk7XfMGxjuzBbjZUvSemLB+01PtxJpCG9ZVXWOqOVBs11R0xd92tWfE2nakCINfAHKXAapkoO2fDz8SZ2VlM67DrdH7pI6OKrxV7oHYSpUdImMcEJP6iEalUNNZ3avIdMYzzkPCL3jSp3VSmSIgsY1bE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0hmR66rd; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="0hmR66rd" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 74FAC1F000E9; Thu, 30 Jul 2026 15:33:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1785425632; bh=JF3zpmpAWdZ0xEdmz0rjeuWBhluw8Kf447UdgHKjMX4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=0hmR66rdEN/SslQzO6YsJnWEwm0mYP5wY0D2I5Dbe8AdRGCl+1oB16a2gh305ot9b Pz+A13KLNr6GzsgD2TEMLsOpu42u1Xfkx0VRyh9Gb5YSZ1T9+CeXqbLsX6fJx4utr7 YcUXkjtnK309bbCoKQ1B4KjxvVix65ct/ZA618Ew= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Gaole Zhang , Baochen Qiang , Rameshkumar Sundaram , Jeff Johnson , Sasha Levin Subject: [PATCH 6.12 135/602] wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin Date: Thu, 30 Jul 2026 16:08:47 +0200 Message-ID: <20260730141438.820104855@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260730141435.976815864@linuxfoundation.org> References: <20260730141435.976815864@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Gaole Zhang [ Upstream commit e8d85672dd7e2523f774caafba8f858384e18df7 ] In ATH11K_QMI_EVENT_FW_READY, ATH11K_FLAG_REGISTERED is set unconditionally even when ath11k_core_qmi_firmware_ready() fails. This leaves the driver in an inconsistent state where initialization is considered complete although the firmware ready handling did not finish successfully. During the subsequent SSR, the driver enters the restart path based on this incorrect state and dereferences uninitialized srng members, resulting in a NULL pointer dereference. Call trace: ath11k_hal_srng_access_begin+0xc/0x60 [ath11k] (P) ath11k_ce_cleanup_pipes+0x17c/0x180 [ath11k] ath11k_core_restart+0x40/0x168 [ath11k] Fix this by: - skipping firmware_ready if ATH11K_FLAG_REGISTERED is already set - setting ATH11K_FLAG_REGISTERED only when firmware_ready succeeds - setting ATH11K_FLAG_QMI_FAIL and aborting the FW_READY handling on error Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.2.0.c2-00204-QCAMSLSWPLZ-1 Fixes: 6fe62a8cec51c ("wifi: ath11k: Add cold boot calibration support on WCN6750") Signed-off-by: Gaole Zhang Reviewed-by: Baochen Qiang Reviewed-by: Rameshkumar Sundaram Link: https://patch.msgid.link/20260609090609.4041009-1-gaole.zhang@oss.qualcomm.com Signed-off-by: Jeff Johnson Signed-off-by: Sasha Levin --- drivers/net/wireless/ath/ath11k/qmi.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/ath/ath11k/qmi.c b/drivers/net/wireless/ath/ath11k/qmi.c index 3ffb7723b67318..0c2527d85532fa 100644 --- a/drivers/net/wireless/ath/ath11k/qmi.c +++ b/drivers/net/wireless/ath/ath11k/qmi.c @@ -3295,9 +3295,14 @@ static void ath11k_qmi_driver_event_work(struct work_struct *work) clear_bit(ATH11K_FLAG_CRASH_FLUSH, &ab->dev_flags); clear_bit(ATH11K_FLAG_RECOVERY, &ab->dev_flags); - ath11k_core_qmi_firmware_ready(ab); - set_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags); - + if (!test_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags)) { + ret = ath11k_core_qmi_firmware_ready(ab); + if (ret) { + set_bit(ATH11K_FLAG_QMI_FAIL, &ab->dev_flags); + break; + } + set_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags); + } break; case ATH11K_QMI_EVENT_COLD_BOOT_CAL_DONE: break; -- 2.53.0