From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
To: Alexander Wilhelm <alexander.wilhelm@westermo.com>
Cc: Jeff Johnson <jjohnson@kernel.org>,
ath12k@lists.infradead.org, linux-wireless@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: ath12k: desc_va endianness problem
Date: Wed, 25 Mar 2026 10:46:10 +0800 [thread overview]
Message-ID: <1c20551c-2cc3-418d-ad18-3a0bcead8b73@oss.qualcomm.com> (raw)
In-Reply-To: <acEh4vckyl6bq29l@FUE-ALEWI-WINX>
On 3/23/2026 7:20 PM, Alexander Wilhelm wrote:
> On Mon, Mar 23, 2026 at 05:31:03PM +0800, Baochen Qiang wrote:
>>
>>
>> On 3/20/2026 5:52 PM, Alexander Wilhelm wrote:
>>> Hello ath12k developers,
>>>
>>> I have another fix for the big endian platform, but unfortunately the data types
>>> do not match here, so I need your support. The problem is the following: the
>>> structs `hal_reo_dest_ring`, `hal_wbm_completion_ring`, and
>>> `hal_wbm_release_ring_cc_rx` all define the members `buf_va_lo` and `buf_va_hi`
>>> as `__le32`. At first glance this seems correct, because the entire structure
>>> contains only little endian fields. The local variable `desc_va` in each
>>> function (see patch below) is of type `u64`, so it makes sense that I would need
>>> to convert from little endian to CPU endian. Unfortunately, this leads to the
>>> following crashes, in `tx_completion` and `rx_process_wbm`, respectivally:
>>>
>>>
>>> Kernel attempted to read user page (40dcdf) - exploit attempt? (uid: 0)
>>> BUG: Unable to handle kernel data access on read at 0x0040dcdf
>>> Faulting instruction address: 0xe209290c
>>> Oops: Kernel access of bad area, sig: 11 [#1]
>>> BE PAGE_SIZE=4K SMP NR_CPUS=4 CoreNet Generic
>>> Modules linked in: ath12k(O) mac80211(O) cfg80211(O) compat(O) ...
>>> CPU: 1 PID: 10200 Comm: jshn Tainted: G O 6.6.73 #0
>>> Hardware name: CyBoxAP-A e5500 0x80241021 CoreNet Generic
>>> NIP: e209290c LR: e2092854 CTR: c08d3190
>>> REGS: dffe3d40 TRAP: 0300 Tainted: G O (6.6.73)
>>> MSR: 00029002 <CE,EE,ME> CR: 44004804 XER: 00000000
>>> DEAR: 0040dcdf ESR: 00000000
>>> GPR00: e2092854 dffe3e30 c328a500 e2092854 0040dcce 00000008 00070000 cf900000
>>> GPR08: 00000000 cf900004 40000000 c8e52c4c c08d3190 1002801c 0fcf5000 c0ab85f8
>>> GPR16: d0d1f7a0 c12a9080 00000001 df7b7f80 00000003 cf900000 e1bc0000 e1ccb988
>>> GPR24: ffffffff c8ed0000 e1cc0220 00000000 c8ec0000 c8ec0000 c8ec0f50 c8ec0000
>>> NIP [e209290c] ath12k_dp_tx_completion_handler+0x22c/0x720 [ath12k]
>>> LR [e2092854] ath12k_dp_tx_completion_handler+0x174/0x720 [ath12k]
>>> Call Trace:
>>> [dffe3e30] [e2092854] ath12k_dp_tx_completion_handler+0x174/0x720 [ath12k] (unreliable)
>>> [dffe3e80] [e208fe18] ath12k_dp_service_srng+0x58/0x380 [ath12k]
>>> [dffe3ed0] [e20a1490] ath12k_pci_hif_resume+0x520/0x8a0 [ath12k]
>>> [dffe3f00] [c067404c] __napi_poll+0x4c/0x260
>>> [dffe3f30] [c06746f8] net_rx_action+0x188/0x340
>>> [dffe3fa0] [c003a3d8] handle_softirqs+0x128/0x280
>>> [dffe3ff0] [c00045b0] do_softirq_own_stack+0x30/0x50
>>> [d0f2fb70] [00000000] 0x0
>>> [d0f2fb90] [c003a7d0] irq_exit+0x70/0xa0
>>> [d0f2fba0] [c0000c84] ExternalInput+0x144/0x160
>>> --- interrupt: 500 at percpu_counter_add_batch+0x9c/0x150
>>> NIP: c0425e8c LR: c01a5964 CTR: c01764e0
>>> REGS: d0f2fbb0 TRAP: 0500 Tainted: G O (6.6.73)
>>> MSR: 00029002 <CE,EE,ME> CR: 48008802 XER: 20000000
>>>
>>> GPR00: c01a5a00 d0f2fca0 c328a500 c1db7300 dffc0f20 00000000 fffffffc 00021002
>>> GPR08: 1e763000 e1091054 00000007 c12b0530 88002808 1002801c 0fcf5000 c0ab85f8
>>> GPR16: d0d1f7a0 dffc0f20 00000000 000003fe 00000000 f92412bd 00000003 c9525480
>>> GPR24: d0f2fd74 c8a501f8 c12b0530 00029002 00000007 00000000 0000000b c1db7300
>>> NIP [c0425e8c] percpu_counter_add_batch+0x9c/0x150
>>> LR [c01a5964] unmap_page_range+0x484/0x820
>>> --- interrupt: 500
>>> [d0f2fca0] [00000001] 0x1 (unreliable)
>>> [d0f2fcd0] [c01a5a00] unmap_page_range+0x520/0x820
>>> [d0f2fd60] [c01a5d9c] unmap_vmas+0x9c/0xe0
>>> [d0f2fda0] [c01afef4] exit_mmap+0xb4/0x2a0
>>> [d0f2fe40] [c0031610] mmput+0x40/0x140
>>> [d0f2fe60] [c0038df4] do_exit+0x2b4/0x990
>>> [d0f2feb0] [c00396c4] do_group_exit+0x34/0xa0
>>> [d0f2fed0] [c0039748] sys_exit_group+0x18/0x20
>>> [d0f2fee0] [c000dbac] system_call_exception+0xac/0x1f0
>>> [d0f2ff00] [c00110e8] ret_from_syscall+0x0/0x28
>>> --- interrupt: c00 at 0xfded438
>>> NIP: 0fded438 LR: 0ff23958 CTR: 0fd94930
>>> REGS: d0f2ff10 TRAP: 0c00 Tainted: G O (6.6.73)
>>> MSR: 0002f902 <CE,EE,PR,FP,ME> CR: 28002402 XER: 20000000
>>>
>>> GPR00: 000000ea bff93390 b0316520 00000000 113e8af0 113e8af0 00000000 00000000
>>> GPR08: 00000000 00000000 00000000 ffffffff b02ccb04 1002801c 100a0000 bfbc4260
>>> GPR16: 114974b0 00000000 114a4de0 00000000 b02cc900 00000001 00000000 00000001
>>> GPR24: 0ff239a0 00000000 00000001 00000000 b030f52c fffff000 0ff23958 00000000
>>> NIP [0fded438] 0xfded438
>>> LR [0ff23958] 0xff23958
>>> --- interrupt: c00
>>> Code: 512a421e 2e140000 512a463e 40f20008 555b9f3e 39350004 754a4000 7c804c2c 41c20224 7c87442c 2c040000 41c20230 <88a40011> 7fc3f378 83a40008 8a640010
>>> ---[ end trace 0000000000000000 ]---
>>>
>>> Kernel panic - not syncing: Fatal exception
>>> ---[ end Kernel panic - not syncing: Fatal exception ]---
>>>
>>>
>>> user@root:~# Kernel attempted to read user page (c011de) - exploit attempt? (uid: 0)
>>> BUG: Unable to handle kernel data access on read at 0x00c011de
>>> Faulting instruction address: 0xe1e3dc44
>>> Oops: Kernel access of bad area, sig: 11 [#1]
>>> BE PAGE_SIZE=4K SMP NR_CPUS=4 CoreNet Generic
>>> Modules linked in: ...
>>> CPU: 1 PID: 0 Comm: swapper/1 Tainted: G O 6.6.73 #0
>>> Hardware name: CyBoxAP-A e5500 0x80241021 CoreNet Generic
>>> NIP: e1e3dc44 LR: e1e3dc30 CTR: c08d40e0
>>> REGS: dffe3ce0 TRAP: 0300 Tainted: G O (6.6.73)
>>> MSR: 00029002 <CE,EE,ME> CR: 44004402 XER: 00000000
>>> DEAR: 00c011de ESR: 00000000
>>> GPR00: e1e33154 dffe3dd0 c1870000 00000000 cebe0000 00000000 00000000 00c011ce
>>> GPR08: 00000001 00000000 00020000 c30a294c c08d40e0 00000000 00000001 00000000
>>> GPR16: e1ce2668 c9270000 c9269a18 c92664d0 e1ce26dc 00000000 babababa dffe3df4
>>> GPR24: 00000040 00000000 c9266480 dffe3dec dffe3e04 c9260000 00c011ce c9269a18
>>> NIP [e1e3dc44] ath12k_dp_rx_process_wbm_err+0x124/0x600 [ath12k]
>>> LR [e1e3dc30] ath12k_dp_rx_process_wbm_err+0x110/0x600 [ath12k]
>>> Call Trace:
>>> [dffe3dd0] [c0ab8e30] 0xc0ab8e30 (unreliable)
>>> [dffe3e80] [e1e33154] ath12k_dp_service_srng+0x314/0x380 [ath12k]
>>> [dffe3ed0] [e1e44540] ath12k_pci_hif_resume+0x520/0x8a0 [ath12k]
>>> [dffe3f00] [c0674c7c] __napi_poll+0x4c/0x260
>>> [dffe3f30] [c0675328] net_rx_action+0x188/0x340
>>> [dffe3fa0] [c003a3d8] handle_softirqs+0x128/0x280
>>> [dffe3ff0] [c00045b0] do_softirq_own_stack+0x30/0x50
>>> [c18c7e10] [c12b040c] 0xc12b040c
>>> [c18c7e30] [c003a7d0] irq_exit+0x70/0xa0
>>> [c18c7e40] [c0000c84] ExternalInput+0x144/0x160
>>> --- interrupt: 500 at arch_cpu_idle+0x24/0x50
>>> NIP: c00071f4 LR: c00071f4 CTR: c000fe14
>>> REGS: c18c7e50 TRAP: 0500 Tainted: G O (6.6.73)
>>> MSR: 0002b002 <CE,EE,FP,ME> CR: 84000402 XER: 00000000
>>>
>>> GPR00: c08cc978 c18c7f40 c1870000 00000005 00000001 40000000 c328becc c12b0530
>>> GPR08: c12b0530 c000fe14 0098ca91 00154674 24000402 00000000 00000001 00000000
>>> GPR16: 00000000 00000000 c00119a0 dffee5f0 00000001 00000000 ffffffff c1050254
>>> GPR24: c12c0000 c0011970 c0011940 c12d0000 00000004 c12b040c c12b0000 00000001
>>> NIP [c00071f4] arch_cpu_idle+0x24/0x50
>>> LR [c00071f4] arch_cpu_idle+0x24/0x50
>>> --- interrupt: 500
>>> [c18c7f40] [c0a367e0] 0xc0a367e0 (unreliable)
>>> [c18c7f50] [c08cc978] default_idle_call+0x38/0x58
>>> [c18c7f60] [c007b3b0] do_idle+0xf0/0x130
>>> [c18c7f80] [c007b580] cpu_startup_entry+0x30/0x40
>>> [c18c7fa0] [c001325c] start_secondary+0x48c/0x930
>>> [c18c7ff0] [c0002870] __secondary_start+0x90/0xdc
>>> Code: 7fa3eb78 4bfcba59 7c641b79 41c20144 38a10044 7fa3eb78 4bfcdb85 7c651b79 40c2026c 83c10058 2c1e0000 41c202d0 <813e0010> 7c09b000 41c20010 7e84a378
>>> ---[ end trace 0000000000000000 ]---
>>>
>>> Kernel panic - not syncing: Fatal exception
>>> ---[ end Kernel panic - not syncing: Fatal exception ]---
>>>
>>>
>>> My fix, as shown in the patch below, is to remove the conversion. But then the
>>> member variables `buf_va_lo` and `buf_va_hi` must be `u32`, which is obviously
>>> wrong. Alternatively, `desc_va` must be `__le64`, but that is likely also
>>> incorrect, because the address is simply dereferenced, and this clearly requires
>>> CPU endianness. What I also do not fully understand is who actually fills these
>>> addresses and at which stage this happens. I hope you can help clarify this so
>>> that I can provide a correct patch for this issue afterward.
>>>
>>>
>>
>> hmm, i am not sure here, but can you please try
>>
>> diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c
>> index 1c82d927d27b..f142759a217b 100644
>> --- a/drivers/net/wireless/ath/ath12k/dp.c
>> +++ b/drivers/net/wireless/ath/ath12k/dp.c
>> @@ -1246,7 +1246,7 @@ static int ath12k_dp_cc_desc_init(struct ath12k_base *ab)
>>
>> /* Update descriptor VA in SPT */
>> rx_desc_addr = ath12k_dp_cc_get_desc_addr_ptr(dp, ppt_idx, j);
>> - *rx_desc_addr = &rx_descs[j];
>> + *rx_desc_addr = (struct ath12k_rx_desc_info
>> *)cpu_to_le64(&rx_descs[j]);
>> }
>> }
>>
>> @@ -1286,7 +1286,7 @@ static int ath12k_dp_cc_desc_init(struct ath12k_base *ab)
>> /* Update descriptor VA in SPT */
>> tx_desc_addr =
>> ath12k_dp_cc_get_desc_addr_ptr(dp, ppt_idx, j);
>> - *tx_desc_addr = &tx_descs[j];
>> + *tx_desc_addr = (struct ath12k_tx_desc_info
>> *)cpu_to_le64(&tx_descs[j]);
>> }
>> }
>> spin_unlock_bh(&dp->tx_desc_lock[pool_id]);
>>
>
> Hi Baochen,
>
> It actually worked, although the solution isn't entirely clean. Sparse
> consequently complains with:
>
> dp.c:1249:42: warning: cast from restricted __le64
> dp.c:1289:50: warning: cast from restricted __le64
>
> To be honest, I also don't quite understand why the struct pointer has to be in
> little endian at this point. The function `ath12k_dp_cc_get_desc_addr_ptr`
> returns an offset from the `vaddr` inside the `spt_info` struct, stored as a
> `u64`. But dereferencing it suddenly treats it as little endian. Shouldn't
> `vaddr` itself perhaps be a `__le64`?
that piece of memory is for direct access by the target, so yes I think 'vaddr' should be
defined as __le64.
>
>
> Best regards
> Alexander Wilhelm
next prev parent reply other threads:[~2026-03-25 2:46 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-20 9:52 ath12k: desc_va endianness problem Alexander Wilhelm
2026-03-23 9:31 ` Baochen Qiang
2026-03-23 11:20 ` Alexander Wilhelm
2026-03-25 2:46 ` Baochen Qiang [this message]
2026-03-25 12:59 ` Alexander Wilhelm
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1c20551c-2cc3-418d-ad18-3a0bcead8b73@oss.qualcomm.com \
--to=baochen.qiang@oss.qualcomm.com \
--cc=alexander.wilhelm@westermo.com \
--cc=ath12k@lists.infradead.org \
--cc=jjohnson@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox