Re: ath12k: desc_va endianness problem

[Alexander Wilhelm <alexander.wilhelm@westermo.com>]

On Wed, Mar 25, 2026 at 10:46:10AM +0800, Baochen Qiang wrote:
> 
> 
> On 3/23/2026 7:20 PM, Alexander Wilhelm wrote:
> > On Mon, Mar 23, 2026 at 05:31:03PM +0800, Baochen Qiang wrote:
> >>
> >>
> >> On 3/20/2026 5:52 PM, Alexander Wilhelm wrote:
> >>> Hello ath12k developers,
> >>>
> >>> I have another fix for the big endian platform, but unfortunately the data types
> >>> do not match here, so I need your support. The problem is the following: the
> >>> structs `hal_reo_dest_ring`, `hal_wbm_completion_ring`, and
> >>> `hal_wbm_release_ring_cc_rx` all define the members `buf_va_lo` and `buf_va_hi`
> >>> as `__le32`. At first glance this seems correct, because the entire structure
> >>> contains only little endian fields. The local variable `desc_va` in each
> >>> function (see patch below) is of type `u64`, so it makes sense that I would need
> >>> to convert from little endian to CPU endian. Unfortunately, this leads to the
> >>> following crashes, in `tx_completion` and `rx_process_wbm`, respectivally:
> >>>
> >>>
> >>>     Kernel attempted to read user page (40dcdf) - exploit attempt? (uid: 0)
> >>>     BUG: Unable to handle kernel data access on read at 0x0040dcdf
> >>>     Faulting instruction address: 0xe209290c
> >>>     Oops: Kernel access of bad area, sig: 11 [#1]
> >>>     BE PAGE_SIZE=4K SMP NR_CPUS=4 CoreNet Generic
> >>>     Modules linked in: ath12k(O) mac80211(O) cfg80211(O) compat(O) ...
> >>>     CPU: 1 PID: 10200 Comm: jshn Tainted: G           O       6.6.73 #0
> >>>     Hardware name: CyBoxAP-A e5500 0x80241021 CoreNet Generic
> >>>     NIP:  e209290c LR: e2092854 CTR: c08d3190
> >>>     REGS: dffe3d40 TRAP: 0300   Tainted: G           O        (6.6.73)
> >>>     MSR:  00029002 <CE,EE,ME>  CR: 44004804  XER: 00000000
> >>>     DEAR: 0040dcdf ESR: 00000000 
> >>>     GPR00: e2092854 dffe3e30 c328a500 e2092854 0040dcce 00000008 00070000 cf900000 
> >>>     GPR08: 00000000 cf900004 40000000 c8e52c4c c08d3190 1002801c 0fcf5000 c0ab85f8 
> >>>     GPR16: d0d1f7a0 c12a9080 00000001 df7b7f80 00000003 cf900000 e1bc0000 e1ccb988 
> >>>     GPR24: ffffffff c8ed0000 e1cc0220 00000000 c8ec0000 c8ec0000 c8ec0f50 c8ec0000 
> >>>     NIP [e209290c] ath12k_dp_tx_completion_handler+0x22c/0x720 [ath12k]
> >>>     LR [e2092854] ath12k_dp_tx_completion_handler+0x174/0x720 [ath12k]
> >>>     Call Trace:
> >>>     [dffe3e30] [e2092854] ath12k_dp_tx_completion_handler+0x174/0x720 [ath12k] (unreliable)
> >>>     [dffe3e80] [e208fe18] ath12k_dp_service_srng+0x58/0x380 [ath12k]
> >>>     [dffe3ed0] [e20a1490] ath12k_pci_hif_resume+0x520/0x8a0 [ath12k]
> >>>     [dffe3f00] [c067404c] __napi_poll+0x4c/0x260
> >>>     [dffe3f30] [c06746f8] net_rx_action+0x188/0x340
> >>>     [dffe3fa0] [c003a3d8] handle_softirqs+0x128/0x280
> >>>     [dffe3ff0] [c00045b0] do_softirq_own_stack+0x30/0x50
> >>>     [d0f2fb70] [00000000] 0x0
> >>>     [d0f2fb90] [c003a7d0] irq_exit+0x70/0xa0
> >>>     [d0f2fba0] [c0000c84] ExternalInput+0x144/0x160
> >>>     --- interrupt: 500 at percpu_counter_add_batch+0x9c/0x150
> >>>     NIP:  c0425e8c LR: c01a5964 CTR: c01764e0
> >>>     REGS: d0f2fbb0 TRAP: 0500   Tainted: G           O        (6.6.73)
> >>>     MSR:  00029002 <CE,EE,ME>  CR: 48008802  XER: 20000000
> >>>
> >>>     GPR00: c01a5a00 d0f2fca0 c328a500 c1db7300 dffc0f20 00000000 fffffffc 00021002 
> >>>     GPR08: 1e763000 e1091054 00000007 c12b0530 88002808 1002801c 0fcf5000 c0ab85f8 
> >>>     GPR16: d0d1f7a0 dffc0f20 00000000 000003fe 00000000 f92412bd 00000003 c9525480 
> >>>     GPR24: d0f2fd74 c8a501f8 c12b0530 00029002 00000007 00000000 0000000b c1db7300 
> >>>     NIP [c0425e8c] percpu_counter_add_batch+0x9c/0x150
> >>>     LR [c01a5964] unmap_page_range+0x484/0x820
> >>>     --- interrupt: 500
> >>>     [d0f2fca0] [00000001] 0x1 (unreliable)
> >>>     [d0f2fcd0] [c01a5a00] unmap_page_range+0x520/0x820
> >>>     [d0f2fd60] [c01a5d9c] unmap_vmas+0x9c/0xe0
> >>>     [d0f2fda0] [c01afef4] exit_mmap+0xb4/0x2a0
> >>>     [d0f2fe40] [c0031610] mmput+0x40/0x140
> >>>     [d0f2fe60] [c0038df4] do_exit+0x2b4/0x990
> >>>     [d0f2feb0] [c00396c4] do_group_exit+0x34/0xa0
> >>>     [d0f2fed0] [c0039748] sys_exit_group+0x18/0x20
> >>>     [d0f2fee0] [c000dbac] system_call_exception+0xac/0x1f0
> >>>     [d0f2ff00] [c00110e8] ret_from_syscall+0x0/0x28
> >>>     --- interrupt: c00 at 0xfded438
> >>>     NIP:  0fded438 LR: 0ff23958 CTR: 0fd94930
> >>>     REGS: d0f2ff10 TRAP: 0c00   Tainted: G           O        (6.6.73)
> >>>     MSR:  0002f902 <CE,EE,PR,FP,ME>  CR: 28002402  XER: 20000000
> >>>
> >>>     GPR00: 000000ea bff93390 b0316520 00000000 113e8af0 113e8af0 00000000 00000000 
> >>>     GPR08: 00000000 00000000 00000000 ffffffff b02ccb04 1002801c 100a0000 bfbc4260 
> >>>     GPR16: 114974b0 00000000 114a4de0 00000000 b02cc900 00000001 00000000 00000001 
> >>>     GPR24: 0ff239a0 00000000 00000001 00000000 b030f52c fffff000 0ff23958 00000000 
> >>>     NIP [0fded438] 0xfded438
> >>>     LR [0ff23958] 0xff23958
> >>>     --- interrupt: c00
> >>>     Code: 512a421e 2e140000 512a463e 40f20008 555b9f3e 39350004 754a4000 7c804c2c 41c20224 7c87442c 2c040000 41c20230 <88a40011> 7fc3f378 83a40008 8a640010
> >>>     ---[ end trace 0000000000000000 ]---
> >>>
> >>>     Kernel panic - not syncing: Fatal exception
> >>>     ---[ end Kernel panic - not syncing: Fatal exception ]---
> >>>
> >>>
> >>>     user@root:~# Kernel attempted to read user page (c011de) - exploit attempt? (uid: 0)
> >>>     BUG: Unable to handle kernel data access on read at 0x00c011de
> >>>     Faulting instruction address: 0xe1e3dc44
> >>>     Oops: Kernel access of bad area, sig: 11 [#1]
> >>>     BE PAGE_SIZE=4K SMP NR_CPUS=4 CoreNet Generic
> >>>     Modules linked in: ...
> >>>     CPU: 1 PID: 0 Comm: swapper/1 Tainted: G           O       6.6.73 #0
> >>>     Hardware name: CyBoxAP-A e5500 0x80241021 CoreNet Generic
> >>>     NIP:  e1e3dc44 LR: e1e3dc30 CTR: c08d40e0
> >>>     REGS: dffe3ce0 TRAP: 0300   Tainted: G           O        (6.6.73)
> >>>     MSR:  00029002 <CE,EE,ME>  CR: 44004402  XER: 00000000
> >>>     DEAR: 00c011de ESR: 00000000 
> >>>     GPR00: e1e33154 dffe3dd0 c1870000 00000000 cebe0000 00000000 00000000 00c011ce 
> >>>     GPR08: 00000001 00000000 00020000 c30a294c c08d40e0 00000000 00000001 00000000 
> >>>     GPR16: e1ce2668 c9270000 c9269a18 c92664d0 e1ce26dc 00000000 babababa dffe3df4 
> >>>     GPR24: 00000040 00000000 c9266480 dffe3dec dffe3e04 c9260000 00c011ce c9269a18 
> >>>     NIP [e1e3dc44] ath12k_dp_rx_process_wbm_err+0x124/0x600 [ath12k]
> >>>     LR [e1e3dc30] ath12k_dp_rx_process_wbm_err+0x110/0x600 [ath12k]
> >>>     Call Trace:
> >>>     [dffe3dd0] [c0ab8e30] 0xc0ab8e30 (unreliable)
> >>>     [dffe3e80] [e1e33154] ath12k_dp_service_srng+0x314/0x380 [ath12k]
> >>>     [dffe3ed0] [e1e44540] ath12k_pci_hif_resume+0x520/0x8a0 [ath12k]
> >>>     [dffe3f00] [c0674c7c] __napi_poll+0x4c/0x260
> >>>     [dffe3f30] [c0675328] net_rx_action+0x188/0x340
> >>>     [dffe3fa0] [c003a3d8] handle_softirqs+0x128/0x280
> >>>     [dffe3ff0] [c00045b0] do_softirq_own_stack+0x30/0x50
> >>>     [c18c7e10] [c12b040c] 0xc12b040c
> >>>     [c18c7e30] [c003a7d0] irq_exit+0x70/0xa0
> >>>     [c18c7e40] [c0000c84] ExternalInput+0x144/0x160
> >>>     --- interrupt: 500 at arch_cpu_idle+0x24/0x50
> >>>     NIP:  c00071f4 LR: c00071f4 CTR: c000fe14
> >>>     REGS: c18c7e50 TRAP: 0500   Tainted: G           O        (6.6.73)
> >>>     MSR:  0002b002 <CE,EE,FP,ME>  CR: 84000402  XER: 00000000
> >>>
> >>>     GPR00: c08cc978 c18c7f40 c1870000 00000005 00000001 40000000 c328becc c12b0530 
> >>>     GPR08: c12b0530 c000fe14 0098ca91 00154674 24000402 00000000 00000001 00000000 
> >>>     GPR16: 00000000 00000000 c00119a0 dffee5f0 00000001 00000000 ffffffff c1050254 
> >>>     GPR24: c12c0000 c0011970 c0011940 c12d0000 00000004 c12b040c c12b0000 00000001 
> >>>     NIP [c00071f4] arch_cpu_idle+0x24/0x50
> >>>     LR [c00071f4] arch_cpu_idle+0x24/0x50
> >>>     --- interrupt: 500
> >>>     [c18c7f40] [c0a367e0] 0xc0a367e0 (unreliable)
> >>>     [c18c7f50] [c08cc978] default_idle_call+0x38/0x58
> >>>     [c18c7f60] [c007b3b0] do_idle+0xf0/0x130
> >>>     [c18c7f80] [c007b580] cpu_startup_entry+0x30/0x40
> >>>     [c18c7fa0] [c001325c] start_secondary+0x48c/0x930
> >>>     [c18c7ff0] [c0002870] __secondary_start+0x90/0xdc
> >>>     Code: 7fa3eb78 4bfcba59 7c641b79 41c20144 38a10044 7fa3eb78 4bfcdb85 7c651b79 40c2026c 83c10058 2c1e0000 41c202d0 <813e0010> 7c09b000 41c20010 7e84a378
> >>>     ---[ end trace 0000000000000000 ]---
> >>>
> >>>     Kernel panic - not syncing: Fatal exception
> >>>     ---[ end Kernel panic - not syncing: Fatal exception ]---
> >>>
> >>>
> >>> My fix, as shown in the patch below, is to remove the conversion. But then the
> >>> member variables `buf_va_lo` and `buf_va_hi` must be `u32`, which is obviously
> >>> wrong. Alternatively, `desc_va` must be `__le64`, but that is likely also
> >>> incorrect, because the address is simply dereferenced, and this clearly requires
> >>> CPU endianness. What I also do not fully understand is who actually fills these
> >>> addresses and at which stage this happens. I hope you can help clarify this so
> >>> that I can provide a correct patch for this issue afterward.
> >>>
> >>>
> >>
> >> hmm, i am not sure here, but can you please try
> >>
> >> diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c
> >> index 1c82d927d27b..f142759a217b 100644
> >> --- a/drivers/net/wireless/ath/ath12k/dp.c
> >> +++ b/drivers/net/wireless/ath/ath12k/dp.c
> >> @@ -1246,7 +1246,7 @@ static int ath12k_dp_cc_desc_init(struct ath12k_base *ab)
> >>
> >>                         /* Update descriptor VA in SPT */
> >>                         rx_desc_addr = ath12k_dp_cc_get_desc_addr_ptr(dp, ppt_idx, j);
> >> -                       *rx_desc_addr = &rx_descs[j];
> >> +                       *rx_desc_addr = (struct ath12k_rx_desc_info
> >> *)cpu_to_le64(&rx_descs[j]);
> >>                 }
> >>         }
> >>
> >> @@ -1286,7 +1286,7 @@ static int ath12k_dp_cc_desc_init(struct ath12k_base *ab)
> >>                                 /* Update descriptor VA in SPT */
> >>                                 tx_desc_addr =
> >>                                         ath12k_dp_cc_get_desc_addr_ptr(dp, ppt_idx, j);
> >> -                               *tx_desc_addr = &tx_descs[j];
> >> +                               *tx_desc_addr = (struct ath12k_tx_desc_info
> >> *)cpu_to_le64(&tx_descs[j]);
> >>                         }
> >>                 }
> >>                 spin_unlock_bh(&dp->tx_desc_lock[pool_id]);
> >>
> > 
> > Hi Baochen,
> > 
> > It actually worked, although the solution isn't entirely clean. Sparse
> > consequently complains with:
> > 
> >     dp.c:1249:42: warning: cast from restricted __le64
> >     dp.c:1289:50: warning: cast from restricted __le64
> > 
> > To be honest, I also don't quite understand why the struct pointer has to be in
> > little endian at this point. The function `ath12k_dp_cc_get_desc_addr_ptr`
> > returns an offset from the `vaddr` inside the `spt_info` struct, stored as a
> > `u64`. But dereferencing it suddenly treats it as little endian. Shouldn't
> > `vaddr` itself perhaps be a `__le64`?
> 
> that piece of memory is for direct access by the target, so yes I think 'vaddr' should be
> defined as __le64.

Thanks again, Baochen. I've prepared a patch now, and it's working. I'll send it
shortly.


Best regards
Alexander Wilhelm