Archive-only list for patches
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev, Ziyang Huang <hzyitc@outlook.com>,
	Kalle Valo <quic_kvalo@quicinc.com>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH 6.1 08/92] wifi: ath11k: Add missing hw_ops->get_ring_selector() for IPQ5018
Date: Mon, 31 Aug 2026 15:34:06 +0200	[thread overview]
Message-ID: <20260831133359.904450963@linuxfoundation.org> (raw)
In-Reply-To: <20260831133359.482388899@linuxfoundation.org>

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ziyang Huang <hzyitc@outlook.com>

[ Upstream commit ce282d8de71f07f0056ea319541141152c65f552 ]

During sending data after clients connected, hw_ops->get_ring_selector()
will be called. But for IPQ5018, this member isn't set, and the
following NULL pointer exception will be occurred:

	[   38.840478] 8<--- cut here ---
	[   38.840517] Unable to handle kernel NULL pointer dereference at virtual address 00000000
	...
	[   38.923161] PC is at 0x0
	[   38.927930] LR is at ath11k_dp_tx+0x70/0x730 [ath11k]
	...
	[   39.063264] Process hostapd (pid: 1034, stack limit = 0x801ceb3d)
	[   39.068994] Stack: (0x856a9a68 to 0x856aa000)
	...
	[   39.438467] [<7f323804>] (ath11k_dp_tx [ath11k]) from [<7f314e6c>] (ath11k_mac_op_tx+0x80/0x190 [ath11k])
	[   39.446607] [<7f314e6c>] (ath11k_mac_op_tx [ath11k]) from [<7f17dbe0>] (ieee80211_handle_wake_tx_queue+0x7c/0xc0 [mac80211])
	[   39.456162] [<7f17dbe0>] (ieee80211_handle_wake_tx_queue [mac80211]) from [<7f174450>] (ieee80211_probereq_get+0x584/0x704 [mac80211])
	[   39.467443] [<7f174450>] (ieee80211_probereq_get [mac80211]) from [<7f178c40>] (ieee80211_tx_prepare_skb+0x1f8/0x248 [mac80211])
	[   39.479334] [<7f178c40>] (ieee80211_tx_prepare_skb [mac80211]) from [<7f179e28>] (__ieee80211_subif_start_xmit+0x32c/0x3d4 [mac80211])
	[   39.491053] [<7f179e28>] (__ieee80211_subif_start_xmit [mac80211]) from [<7f17af08>] (ieee80211_tx_control_port+0x19c/0x288 [mac80211])
	[   39.502946] [<7f17af08>] (ieee80211_tx_control_port [mac80211]) from [<7f0fc704>] (nl80211_tx_control_port+0x174/0x1d4 [cfg80211])
	[   39.515017] [<7f0fc704>] (nl80211_tx_control_port [cfg80211]) from [<808ceac4>] (genl_rcv_msg+0x154/0x340)
	[   39.526814] [<808ceac4>] (genl_rcv_msg) from [<808cdb74>] (netlink_rcv_skb+0xb8/0x11c)
	[   39.536446] [<808cdb74>] (netlink_rcv_skb) from [<808ce1d0>] (genl_rcv+0x28/0x34)
	[   39.544344] [<808ce1d0>] (genl_rcv) from [<808cd234>] (netlink_unicast+0x174/0x274)
	[   39.551895] [<808cd234>] (netlink_unicast) from [<808cd510>] (netlink_sendmsg+0x1dc/0x440)
	[   39.559362] [<808cd510>] (netlink_sendmsg) from [<808596e0>] (____sys_sendmsg+0x1a8/0x1fc)
	[   39.567697] [<808596e0>] (____sys_sendmsg) from [<8085b1a8>] (___sys_sendmsg+0xa4/0xdc)
	[   39.575941] [<8085b1a8>] (___sys_sendmsg) from [<8085b310>] (sys_sendmsg+0x44/0x74)
	[   39.583841] [<8085b310>] (sys_sendmsg) from [<80300060>] (ret_fast_syscall+0x0/0x40)
	...
	[   39.620734] Code: bad PC value
	[   39.625869] ---[ end trace 8aef983ad3cbc032 ]---

Fixes: ba60f2793d3a ("wifi: ath11k: initialize hw_ops for IPQ5018")
Signed-off-by: Ziyang Huang <hzyitc@outlook.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/TYZPR01MB5556D6E3F63EAB5129D11420C953A@TYZPR01MB5556.apcprd01.prod.exchangelabs.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/hw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath11k/hw.c b/drivers/net/wireless/ath/ath11k/hw.c
index 6b4355a68e266..1e7009743c976 100644
--- a/drivers/net/wireless/ath/ath11k/hw.c
+++ b/drivers/net/wireless/ath/ath11k/hw.c
@@ -1175,7 +1175,7 @@ const struct ath11k_hw_ops ipq5018_ops = {
 	.mpdu_info_get_peerid = ath11k_hw_ipq8074_mpdu_info_get_peerid,
 	.rx_desc_mac_addr2_valid = ath11k_hw_ipq9074_rx_desc_mac_addr2_valid,
 	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2,
-
+	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
 };
 
 #define ATH11K_TX_RING_MASK_0 BIT(0)
-- 
2.53.0




  parent reply	other threads:[~2026-08-31 13:59 UTC|newest]

Thread overview: 97+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-31 13:33 [PATCH 6.1 00/92] 6.1.187-rc1 review Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 6.1 01/92] RDMA/rxe: Fix OOB in free_rd_atomic_resources() Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 02/92] inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 03/92] KVM: x86/mmu: Check write tracking in all address spaces Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 04/92] ext4: dont enable DAX on new encrypted files Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 05/92] io_uring/io-wq: fix worker accounting when canceling creation callbacks Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 06/92] ipvs: reload ip header after head reallocation Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 07/92] Revert "usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal" Greg Kroah-Hartman
2026-08-31 13:34 ` Greg Kroah-Hartman [this message]
2026-08-31 13:34 ` [PATCH 6.1 09/92] drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 10/92] bpf: Remove tst_run from lwt_seg6local_prog_ops Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 11/92] jfs: add check read-only before truncation in jfs_truncate_nolock() Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 12/92] jfs: add check read-only before txBeginAnon() call Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 13/92] ibmvnic: Use kernel helpers for hex dumps Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 14/92] jfs: Fix null-ptr-deref in jfs_ioc_trim Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 15/92] exfat: fix double free in delayed_free Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 16/92] media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 17/92] mISDN: hfcpci: Fix warning when deleting uninitialized timer Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 18/92] can: j1939: implement NETDEV_UNREGISTER notification handler Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 19/92] can: j1939: add missing calls in " Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 20/92] can: j1939: make j1939_sk_bind() fail if device is no longer registered Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 21/92] smc: Fix use-after-free in __pnet_find_base_ndev() Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 22/92] KVM: arm64: Prevent access to vCPU events before init Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 23/92] smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 24/92] smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 25/92] ASoC: nau8821: Cancel delayed work on component remove Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 26/92] bpf: Fix use-after-free in offloaded map/prog info fill Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 27/92] riscv: Fix register corruption from uninitialized cregs on error Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 28/92] Revert "PM: sleep: Use complete() in device_pm_sleep_init()" Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 29/92] ASoC: nau8821: Cancel pending work before suspend Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 30/92] smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk() Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 31/92] selinux: switch two allocations to use kzalloc_objs() Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 32/92] Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup" Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 33/92] Revert "smb: client: use kvzalloc() for megabyte buffer in simple fallocate" Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 34/92] ASoC: tegra: Fix Master Volume Control Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 35/92] block: make bio_check_eod work for zero sized devices Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 36/92] mptcp: pm: fix memory leak from alloc-during-teardown race Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 37/92] ext4: propagate errors from fast commit range replay Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 38/92] nilfs2: correct return value kernel-doc descriptions for ioctl functions Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 39/92] nilfs2: reject invalid block index in GC ioctl Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 40/92] nfc: nci: add data_len bound checks to activation parameter extractors Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 41/92] HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 42/92] HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 43/92] HID: magicmouse: re-enable multitouch after reset-resume Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 44/92] nvme: rename CDR/MORE/DNR to NVME_STATUS_* Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 45/92] nvmet-tcp: bound SGL data length before allocating command buffers Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 46/92] HID: nintendo: stop device IO before hid_hw_stop on probe failure Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 47/92] HID: uclogic: fix use-after-free of inrange_timer on remove Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 48/92] HID: ft260: improve i2c write performance Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 49/92] HID: ft260: improve i2c large reads performance Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 50/92] HID: ft260: skip unexpected HID input reports Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 51/92] HID: ft260: wake up device from power saving mode Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 55/92] Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 56/92] Bluetooth: hci_sync: Fix accept list UAF during suspend Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 57/92] Bluetooth: hci_conn: Fix not matching by CIS ID Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 58/92] Bluetooth: ISO: use correct CIS order in Set CIG Parameters event Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 59/92] Bluetooth: hci_event: fix Set CIG Parameters error status handling Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 60/92] Bluetooth: hci_event: validate LE Set CIG Parameters response Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 6.1 61/92] ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 62/92] fpga: dfl: fme: add error handling Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 63/92] accessibility: speakup: unregister tty ldisc on later init failures Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 64/92] usb: xhci: Handle USB3 port events when there is one roothub Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 65/92] xhci: dbgtty: Fix unregister on tty_register_driver() failure Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 66/92] xhci: dbgtty: Fix unregister on tty_alloc_driver() failure Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 67/92] fuse: fix invalidate lock leak on setattr writeback failure Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 68/92] fuse: fix invalidate lock leak on open O_TRUNC DAX failure Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 69/92] usb: usbtest: disable dynamic ID support Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 70/92] usb: gadget: f_tcm: keep port count until LUN teardown completes Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 71/92] tls: device: fix out-of-bounds write in tls_append_frag() Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 72/92] xfrm: espintcp: fix UAF during close Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 73/92] xfrm: drop ESP-in-TCP packets with no ingress device Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 74/92] xfrm: ah6: validate routing header segments_left Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 75/92] xfrm: fix xfrm_state_construct() auth-trunc leak Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 76/92] net: bridge: mcast: fix use-after-free of a master VLANs multicast context Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 77/92] ipv6: seg6: clear IPv4 control block on IPIP decapsulation Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 80/92] crypto: qce - fix CCM AAD buffer underallocation Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 81/92] crypto: mxs-dcp - fix source scatterlist length access Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 82/92] crypto: qce - Remove unsafe/deprecated algorithms Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 83/92] KVM: s390: vsie: zero stale crypto bits Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 84/92] Bluetooth: hci_core: Fix hci_conn_hash_lookup_cis Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 85/92] usb: core: Add lock to usb_wakeup_notification() Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 86/92] usb: core: Strengthen error handling in hub_hub_status() Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 87/92] ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 88/92] ALSA: usb-audio: Complete cleanup after system-resume errors Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 89/92] USB: serial: option: fix slab OOB read in interrupt URB callback Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 90/92] USB: serial: spcp8x5: drop broken carrier detect support Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 91/92] USB: c67x00: fix use-after-free in c67x00_add_iso_urb() Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 6.1 92/92] usb: usbfs: fix use-after-free of usb_device in usbdev_release() Greg Kroah-Hartman
2026-08-31 17:50 ` [PATCH 6.1 00/92] 6.1.187-rc1 review Florian Fainelli
2026-08-31 18:15 ` Francesco Dolcini
2026-08-31 19:12 ` Brett A C Sheffield
2026-08-31 19:41 ` Peter Schneider
2026-09-01  8:45 ` Pavel Machek
2026-09-01 11:36 ` Barry K. Nathan
2026-09-01 16:46 ` Shuah Khan
2026-09-01 22:25 ` Miguel Ojeda
2026-09-01 23:26 ` Ron Economos

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260831133359.904450963@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=hzyitc@outlook.com \
    --cc=patches@lists.linux.dev \
    --cc=quic_kvalo@quicinc.com \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox