[PATCH] wifi: ath11k: fix suspend use-after-free after probe failure

[PATCH] wifi: ath11k: fix suspend use-after-free after probe failure

[Johan Hovold]

Make sure to deregister the PM notifier to avoid a use-after-free on
suspend in case core initialisation fails (e.g. due to missing
firmware).

Fixes: 32d93b51bc7e ("wifi: ath11k: choose default PM policy for hibernation")
Reported-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/all/d0cd065c-1cd1-4e56-8c57-60777b1f3664@oss.qualcomm.com/
Cc: Baochen Qiang <quic_bqiang@quicinc.com>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
---
 drivers/net/wireless/ath/ath11k/core.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c
index 22a101136135..eb1f35617c64 100644
--- a/drivers/net/wireless/ath/ath11k/core.c
+++ b/drivers/net/wireless/ath/ath11k/core.c
@@ -2581,10 +2581,15 @@ int ath11k_core_init(struct ath11k_base *ab)
 	ret = ath11k_core_soc_create(ab);
 	if (ret) {
 		ath11k_err(ab, "failed to create soc core: %d\n", ret);
-		return ret;
+		goto err_unregister_pm_notifier;
 	}
 
 	return 0;
+
+err_unregister_pm_notifier:
+	ath11k_core_pm_notifier_unregister(ab);
+
+	return ret;
 }
 EXPORT_SYMBOL(ath11k_core_init);
 
-- 
2.49.0

Re: [PATCH] wifi: ath11k: fix suspend use-after-free after probe failure

[Johan Hovold]

On Tue, Jun 24, 2025 at 10:20:22AM +0200, Johan Hovold wrote:
> Make sure to deregister the PM notifier to avoid a use-after-free on
> suspend in case core initialisation fails (e.g. due to missing
> firmware).

Not sure it matters in this case, but forgot to include:

Tested-on: WCN6855 hw2.0 WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41

> Fixes: 32d93b51bc7e ("wifi: ath11k: choose default PM policy for hibernation")
> Reported-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
> Link: https://lore.kernel.org/all/d0cd065c-1cd1-4e56-8c57-60777b1f3664@oss.qualcomm.com/
> Cc: Baochen Qiang <quic_bqiang@quicinc.com>
> Signed-off-by: Johan Hovold <johan+linaro@kernel.org>

Johan

Re: [PATCH] wifi: ath11k: fix suspend use-after-free after probe failure

[Jeff Johnson]

On 6/24/2025 1:32 AM, Johan Hovold wrote:
> On Tue, Jun 24, 2025 at 10:20:22AM +0200, Johan Hovold wrote:
>> Make sure to deregister the PM notifier to avoid a use-after-free on
>> suspend in case core initialisation fails (e.g. due to missing
>> firmware).
> 
> Not sure it matters in this case, but forgot to include:
> 
> Tested-on: WCN6855 hw2.0 WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41

I'll add that.
I'll also change the Link: to Closes: per checkpatch:

WARNING:BAD_REPORTED_BY_LINK: Reported-by: should be immediately followed by Closes: with a URL to the report

> 
>> Fixes: 32d93b51bc7e ("wifi: ath11k: choose default PM policy for hibernation")
>> Reported-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
>> Link: https://lore.kernel.org/all/d0cd065c-1cd1-4e56-8c57-60777b1f3664@oss.qualcomm.com/
>> Cc: Baochen Qiang <quic_bqiang@quicinc.com>
>> Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
> 
> Johan

Re: [PATCH] wifi: ath11k: fix suspend use-after-free after probe failure

[Jeff Johnson]

On 6/24/2025 8:11 AM, Jeff Johnson wrote:
> On 6/24/2025 1:32 AM, Johan Hovold wrote:
>> On Tue, Jun 24, 2025 at 10:20:22AM +0200, Johan Hovold wrote:
>>> Make sure to deregister the PM notifier to avoid a use-after-free on
>>> suspend in case core initialisation fails (e.g. due to missing
>>> firmware).
>>
>> Not sure it matters in this case, but forgot to include:
>>
>> Tested-on: WCN6855 hw2.0 WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
> 
> I'll add that.
> I'll also change the Link: to Closes: per checkpatch:
> 
> WARNING:BAD_REPORTED_BY_LINK: Reported-by: should be immediately followed by Closes: with a URL to the report

Please check pending patch:
https://git.kernel.org/pub/scm/linux/kernel/git/ath/ath.git/commit/?h=pending&id=2418079880408c5ae0b2a93f72af044eaff18cb6

Re: [PATCH] wifi: ath11k: fix suspend use-after-free after probe failure

[Johan Hovold]

On Tue, Jun 24, 2025 at 09:15:51AM -0700, Jeff Johnson wrote:
> On 6/24/2025 8:11 AM, Jeff Johnson wrote:
> > On 6/24/2025 1:32 AM, Johan Hovold wrote:
> >> On Tue, Jun 24, 2025 at 10:20:22AM +0200, Johan Hovold wrote:
> >>> Make sure to deregister the PM notifier to avoid a use-after-free on
> >>> suspend in case core initialisation fails (e.g. due to missing
> >>> firmware).
> >>
> >> Not sure it matters in this case, but forgot to include:
> >>
> >> Tested-on: WCN6855 hw2.0 WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
> > 
> > I'll add that.
> > I'll also change the Link: to Closes: per checkpatch:
> > 
> > WARNING:BAD_REPORTED_BY_LINK: Reported-by: should be immediately followed by Closes: with a URL to the report

Checkpatch is just a tool and it's output should not be treated as
something that you must follow.

Linus reluctantly allowed Closes: to be used as an *alternative* to
Link: [1], but then there was mission creep and now checkpatch has
started warning about a perfectly valid Link: tag after Reported-by:
without that even being made clear in the commit message [2].

I'll stick with Link: (like Linus still do most of the time), but I
don't mind if you want to change this to Closes: for ath11k.

> Please check pending patch:
> https://git.kernel.org/pub/scm/linux/kernel/git/ath/ath.git/commit/?h=pending&id=2418079880408c5ae0b2a93f72af044eaff18cb6

Looks good, thanks.

Johan

[1] https://lore.kernel.org/lkml/CAHk-=wh0v1EeDV3v8TzK81nDC40=XuTdY2MCr0xy3m3FiBV3+Q@mail.gmail.com/
[2] https://lore.kernel.org/lkml/20230314-doc-checkpatch-closes-tag-v4-4-d26d1fa66f9f@tessares.net/

Re: [PATCH] wifi: ath11k: fix suspend use-after-free after probe failure

[Jeff Johnson]

On Tue, 24 Jun 2025 10:20:22 +0200, Johan Hovold wrote:
> Make sure to deregister the PM notifier to avoid a use-after-free on
> suspend in case core initialisation fails (e.g. due to missing
> firmware).
> 
> 

Applied, thanks!

[1/1] wifi: ath11k: fix suspend use-after-free after probe failure
      commit: 8f9480451514c065dc8296c0db6e26d6c467fafe

Best regards,
-- 
Jeff Johnson <jeff.johnson@oss.qualcomm.com>