* ath12k: desc_va endianness problem
@ 2026-03-20 9:52 Alexander Wilhelm
2026-03-23 9:31 ` Baochen Qiang
0 siblings, 1 reply; 5+ messages in thread
From: Alexander Wilhelm @ 2026-03-20 9:52 UTC (permalink / raw)
To: Jeff Johnson; +Cc: ath12k, linux-wireless, linux-kernel
Hello ath12k developers,
I have another fix for the big endian platform, but unfortunately the data types
do not match here, so I need your support. The problem is the following: the
structs `hal_reo_dest_ring`, `hal_wbm_completion_ring`, and
`hal_wbm_release_ring_cc_rx` all define the members `buf_va_lo` and `buf_va_hi`
as `__le32`. At first glance this seems correct, because the entire structure
contains only little endian fields. The local variable `desc_va` in each
function (see patch below) is of type `u64`, so it makes sense that I would need
to convert from little endian to CPU endian. Unfortunately, this leads to the
following crashes, in `tx_completion` and `rx_process_wbm`, respectivally:
Kernel attempted to read user page (40dcdf) - exploit attempt? (uid: 0)
BUG: Unable to handle kernel data access on read at 0x0040dcdf
Faulting instruction address: 0xe209290c
Oops: Kernel access of bad area, sig: 11 [#1]
BE PAGE_SIZE=4K SMP NR_CPUS=4 CoreNet Generic
Modules linked in: ath12k(O) mac80211(O) cfg80211(O) compat(O) ...
CPU: 1 PID: 10200 Comm: jshn Tainted: G O 6.6.73 #0
Hardware name: CyBoxAP-A e5500 0x80241021 CoreNet Generic
NIP: e209290c LR: e2092854 CTR: c08d3190
REGS: dffe3d40 TRAP: 0300 Tainted: G O (6.6.73)
MSR: 00029002 <CE,EE,ME> CR: 44004804 XER: 00000000
DEAR: 0040dcdf ESR: 00000000
GPR00: e2092854 dffe3e30 c328a500 e2092854 0040dcce 00000008 00070000 cf900000
GPR08: 00000000 cf900004 40000000 c8e52c4c c08d3190 1002801c 0fcf5000 c0ab85f8
GPR16: d0d1f7a0 c12a9080 00000001 df7b7f80 00000003 cf900000 e1bc0000 e1ccb988
GPR24: ffffffff c8ed0000 e1cc0220 00000000 c8ec0000 c8ec0000 c8ec0f50 c8ec0000
NIP [e209290c] ath12k_dp_tx_completion_handler+0x22c/0x720 [ath12k]
LR [e2092854] ath12k_dp_tx_completion_handler+0x174/0x720 [ath12k]
Call Trace:
[dffe3e30] [e2092854] ath12k_dp_tx_completion_handler+0x174/0x720 [ath12k] (unreliable)
[dffe3e80] [e208fe18] ath12k_dp_service_srng+0x58/0x380 [ath12k]
[dffe3ed0] [e20a1490] ath12k_pci_hif_resume+0x520/0x8a0 [ath12k]
[dffe3f00] [c067404c] __napi_poll+0x4c/0x260
[dffe3f30] [c06746f8] net_rx_action+0x188/0x340
[dffe3fa0] [c003a3d8] handle_softirqs+0x128/0x280
[dffe3ff0] [c00045b0] do_softirq_own_stack+0x30/0x50
[d0f2fb70] [00000000] 0x0
[d0f2fb90] [c003a7d0] irq_exit+0x70/0xa0
[d0f2fba0] [c0000c84] ExternalInput+0x144/0x160
--- interrupt: 500 at percpu_counter_add_batch+0x9c/0x150
NIP: c0425e8c LR: c01a5964 CTR: c01764e0
REGS: d0f2fbb0 TRAP: 0500 Tainted: G O (6.6.73)
MSR: 00029002 <CE,EE,ME> CR: 48008802 XER: 20000000
GPR00: c01a5a00 d0f2fca0 c328a500 c1db7300 dffc0f20 00000000 fffffffc 00021002
GPR08: 1e763000 e1091054 00000007 c12b0530 88002808 1002801c 0fcf5000 c0ab85f8
GPR16: d0d1f7a0 dffc0f20 00000000 000003fe 00000000 f92412bd 00000003 c9525480
GPR24: d0f2fd74 c8a501f8 c12b0530 00029002 00000007 00000000 0000000b c1db7300
NIP [c0425e8c] percpu_counter_add_batch+0x9c/0x150
LR [c01a5964] unmap_page_range+0x484/0x820
--- interrupt: 500
[d0f2fca0] [00000001] 0x1 (unreliable)
[d0f2fcd0] [c01a5a00] unmap_page_range+0x520/0x820
[d0f2fd60] [c01a5d9c] unmap_vmas+0x9c/0xe0
[d0f2fda0] [c01afef4] exit_mmap+0xb4/0x2a0
[d0f2fe40] [c0031610] mmput+0x40/0x140
[d0f2fe60] [c0038df4] do_exit+0x2b4/0x990
[d0f2feb0] [c00396c4] do_group_exit+0x34/0xa0
[d0f2fed0] [c0039748] sys_exit_group+0x18/0x20
[d0f2fee0] [c000dbac] system_call_exception+0xac/0x1f0
[d0f2ff00] [c00110e8] ret_from_syscall+0x0/0x28
--- interrupt: c00 at 0xfded438
NIP: 0fded438 LR: 0ff23958 CTR: 0fd94930
REGS: d0f2ff10 TRAP: 0c00 Tainted: G O (6.6.73)
MSR: 0002f902 <CE,EE,PR,FP,ME> CR: 28002402 XER: 20000000
GPR00: 000000ea bff93390 b0316520 00000000 113e8af0 113e8af0 00000000 00000000
GPR08: 00000000 00000000 00000000 ffffffff b02ccb04 1002801c 100a0000 bfbc4260
GPR16: 114974b0 00000000 114a4de0 00000000 b02cc900 00000001 00000000 00000001
GPR24: 0ff239a0 00000000 00000001 00000000 b030f52c fffff000 0ff23958 00000000
NIP [0fded438] 0xfded438
LR [0ff23958] 0xff23958
--- interrupt: c00
Code: 512a421e 2e140000 512a463e 40f20008 555b9f3e 39350004 754a4000 7c804c2c 41c20224 7c87442c 2c040000 41c20230 <88a40011> 7fc3f378 83a40008 8a640010
---[ end trace 0000000000000000 ]---
Kernel panic - not syncing: Fatal exception
---[ end Kernel panic - not syncing: Fatal exception ]---
user@root:~# Kernel attempted to read user page (c011de) - exploit attempt? (uid: 0)
BUG: Unable to handle kernel data access on read at 0x00c011de
Faulting instruction address: 0xe1e3dc44
Oops: Kernel access of bad area, sig: 11 [#1]
BE PAGE_SIZE=4K SMP NR_CPUS=4 CoreNet Generic
Modules linked in: ...
CPU: 1 PID: 0 Comm: swapper/1 Tainted: G O 6.6.73 #0
Hardware name: CyBoxAP-A e5500 0x80241021 CoreNet Generic
NIP: e1e3dc44 LR: e1e3dc30 CTR: c08d40e0
REGS: dffe3ce0 TRAP: 0300 Tainted: G O (6.6.73)
MSR: 00029002 <CE,EE,ME> CR: 44004402 XER: 00000000
DEAR: 00c011de ESR: 00000000
GPR00: e1e33154 dffe3dd0 c1870000 00000000 cebe0000 00000000 00000000 00c011ce
GPR08: 00000001 00000000 00020000 c30a294c c08d40e0 00000000 00000001 00000000
GPR16: e1ce2668 c9270000 c9269a18 c92664d0 e1ce26dc 00000000 babababa dffe3df4
GPR24: 00000040 00000000 c9266480 dffe3dec dffe3e04 c9260000 00c011ce c9269a18
NIP [e1e3dc44] ath12k_dp_rx_process_wbm_err+0x124/0x600 [ath12k]
LR [e1e3dc30] ath12k_dp_rx_process_wbm_err+0x110/0x600 [ath12k]
Call Trace:
[dffe3dd0] [c0ab8e30] 0xc0ab8e30 (unreliable)
[dffe3e80] [e1e33154] ath12k_dp_service_srng+0x314/0x380 [ath12k]
[dffe3ed0] [e1e44540] ath12k_pci_hif_resume+0x520/0x8a0 [ath12k]
[dffe3f00] [c0674c7c] __napi_poll+0x4c/0x260
[dffe3f30] [c0675328] net_rx_action+0x188/0x340
[dffe3fa0] [c003a3d8] handle_softirqs+0x128/0x280
[dffe3ff0] [c00045b0] do_softirq_own_stack+0x30/0x50
[c18c7e10] [c12b040c] 0xc12b040c
[c18c7e30] [c003a7d0] irq_exit+0x70/0xa0
[c18c7e40] [c0000c84] ExternalInput+0x144/0x160
--- interrupt: 500 at arch_cpu_idle+0x24/0x50
NIP: c00071f4 LR: c00071f4 CTR: c000fe14
REGS: c18c7e50 TRAP: 0500 Tainted: G O (6.6.73)
MSR: 0002b002 <CE,EE,FP,ME> CR: 84000402 XER: 00000000
GPR00: c08cc978 c18c7f40 c1870000 00000005 00000001 40000000 c328becc c12b0530
GPR08: c12b0530 c000fe14 0098ca91 00154674 24000402 00000000 00000001 00000000
GPR16: 00000000 00000000 c00119a0 dffee5f0 00000001 00000000 ffffffff c1050254
GPR24: c12c0000 c0011970 c0011940 c12d0000 00000004 c12b040c c12b0000 00000001
NIP [c00071f4] arch_cpu_idle+0x24/0x50
LR [c00071f4] arch_cpu_idle+0x24/0x50
--- interrupt: 500
[c18c7f40] [c0a367e0] 0xc0a367e0 (unreliable)
[c18c7f50] [c08cc978] default_idle_call+0x38/0x58
[c18c7f60] [c007b3b0] do_idle+0xf0/0x130
[c18c7f80] [c007b580] cpu_startup_entry+0x30/0x40
[c18c7fa0] [c001325c] start_secondary+0x48c/0x930
[c18c7ff0] [c0002870] __secondary_start+0x90/0xdc
Code: 7fa3eb78 4bfcba59 7c641b79 41c20144 38a10044 7fa3eb78 4bfcdb85 7c651b79 40c2026c 83c10058 2c1e0000 41c202d0 <813e0010> 7c09b000 41c20010 7e84a378
---[ end trace 0000000000000000 ]---
Kernel panic - not syncing: Fatal exception
---[ end Kernel panic - not syncing: Fatal exception ]---
My fix, as shown in the patch below, is to remove the conversion. But then the
member variables `buf_va_lo` and `buf_va_hi` must be `u32`, which is obviously
wrong. Alternatively, `desc_va` must be `__le64`, but that is likely also
incorrect, because the address is simply dereferenced, and this clearly requires
CPU endianness. What I also do not fully understand is who actually fills these
addresses and at which stage this happens. I hope you can help clarify this so
that I can provide a correct patch for this issue afterward.
Best regards
Alexander Wilhelm
---
drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c | 12 ++++++------
drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c | 4 ++--
drivers/net/wireless/ath/ath12k/wifi7/hal_rx.c | 4 ++--
3 files changed, 10 insertions(+), 10 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c b/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c
index e6a934d74e85..8df41ee12025 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c
+++ b/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c
@@ -678,8 +678,8 @@ int ath12k_wifi7_dp_rx_process(struct ath12k_dp *dp, int ring_id,
hw_link_id = le32_get_bits(desc->info0,
HAL_REO_DEST_RING_INFO0_SRC_LINK_ID);
- desc_va = ((u64)le32_to_cpu(desc->buf_va_hi) << 32 |
- le32_to_cpu(desc->buf_va_lo));
+ desc_va = ((u64)desc->buf_va_hi << 32 |
+ desc->buf_va_lo);
desc_info = (struct ath12k_rx_desc_info *)((unsigned long)desc_va);
device_id = hw_links[hw_link_id].device_id;
@@ -1275,8 +1275,8 @@ ath12k_wifi7_dp_process_rx_err_buf(struct ath12k_pdev_dp *dp_pdev,
struct ath12k_rx_desc_info *desc_info;
u64 desc_va;
- desc_va = ((u64)le32_to_cpu(desc->buf_va_hi) << 32 |
- le32_to_cpu(desc->buf_va_lo));
+ desc_va = ((u64)desc->buf_va_hi << 32 |
+ desc->buf_va_lo);
desc_info = (struct ath12k_rx_desc_info *)((unsigned long)desc_va);
/* retry manual desc retrieval */
@@ -1354,8 +1354,8 @@ static int ath12k_dp_h_msdu_buffer_type(struct ath12k_dp *dp,
dp->device_stats.reo_excep_msdu_buf_type++;
- desc_va = (u64)le32_to_cpu(desc->buf_va_hi) << 32 |
- le32_to_cpu(desc->buf_va_lo);
+ desc_va = (u64)desc->buf_va_hi << 32 |
+ desc->buf_va_lo;
desc_info = (struct ath12k_rx_desc_info *)(uintptr_t)desc_va;
if (!desc_info) {
u32 cookie;
diff --git a/drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c b/drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c
index 629084aa36d8..4794e15f0e45 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c
+++ b/drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c
@@ -871,8 +871,8 @@ void ath12k_wifi7_dp_tx_completion_handler(struct ath12k_dp *dp, int ring_id)
if (le32_get_bits(tx_status->info0, HAL_WBM_COMPL_TX_INFO0_CC_DONE)) {
/* HW done cookie conversion */
- desc_va = ((u64)le32_to_cpu(tx_status->buf_va_hi) << 32 |
- le32_to_cpu(tx_status->buf_va_lo));
+ desc_va = ((u64)tx_status->buf_va_hi << 32 |
+ tx_status->buf_va_lo);
tx_desc = (struct ath12k_tx_desc_info *)((unsigned long)desc_va);
} else {
/* SW does cookie conversion to VA */
diff --git a/drivers/net/wireless/ath/ath12k/wifi7/hal_rx.c b/drivers/net/wireless/ath/ath12k/wifi7/hal_rx.c
index 49c693289709..31e41a3d0fc1 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/hal_rx.c
+++ b/drivers/net/wireless/ath/ath12k/wifi7/hal_rx.c
@@ -398,8 +398,8 @@ int ath12k_wifi7_hal_wbm_desc_parse_err(struct ath12k_dp *dp, void *desc,
rel_info->cookie = le32_get_bits(wbm_cc_desc->info1,
HAL_WBM_RELEASE_RX_CC_INFO1_COOKIE);
- desc_va = ((u64)le32_to_cpu(wbm_cc_desc->buf_va_hi) << 32 |
- le32_to_cpu(wbm_cc_desc->buf_va_lo));
+ desc_va = ((u64)wbm_cc_desc->buf_va_hi << 32 |
+ wbm_cc_desc->buf_va_lo);
rel_info->rx_desc =
(struct ath12k_rx_desc_info *)((unsigned long)desc_va);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: ath12k: desc_va endianness problem
2026-03-20 9:52 ath12k: desc_va endianness problem Alexander Wilhelm
@ 2026-03-23 9:31 ` Baochen Qiang
2026-03-23 11:20 ` Alexander Wilhelm
0 siblings, 1 reply; 5+ messages in thread
From: Baochen Qiang @ 2026-03-23 9:31 UTC (permalink / raw)
To: Alexander Wilhelm, Jeff Johnson; +Cc: ath12k, linux-wireless, linux-kernel
On 3/20/2026 5:52 PM, Alexander Wilhelm wrote:
> Hello ath12k developers,
>
> I have another fix for the big endian platform, but unfortunately the data types
> do not match here, so I need your support. The problem is the following: the
> structs `hal_reo_dest_ring`, `hal_wbm_completion_ring`, and
> `hal_wbm_release_ring_cc_rx` all define the members `buf_va_lo` and `buf_va_hi`
> as `__le32`. At first glance this seems correct, because the entire structure
> contains only little endian fields. The local variable `desc_va` in each
> function (see patch below) is of type `u64`, so it makes sense that I would need
> to convert from little endian to CPU endian. Unfortunately, this leads to the
> following crashes, in `tx_completion` and `rx_process_wbm`, respectivally:
>
>
> Kernel attempted to read user page (40dcdf) - exploit attempt? (uid: 0)
> BUG: Unable to handle kernel data access on read at 0x0040dcdf
> Faulting instruction address: 0xe209290c
> Oops: Kernel access of bad area, sig: 11 [#1]
> BE PAGE_SIZE=4K SMP NR_CPUS=4 CoreNet Generic
> Modules linked in: ath12k(O) mac80211(O) cfg80211(O) compat(O) ...
> CPU: 1 PID: 10200 Comm: jshn Tainted: G O 6.6.73 #0
> Hardware name: CyBoxAP-A e5500 0x80241021 CoreNet Generic
> NIP: e209290c LR: e2092854 CTR: c08d3190
> REGS: dffe3d40 TRAP: 0300 Tainted: G O (6.6.73)
> MSR: 00029002 <CE,EE,ME> CR: 44004804 XER: 00000000
> DEAR: 0040dcdf ESR: 00000000
> GPR00: e2092854 dffe3e30 c328a500 e2092854 0040dcce 00000008 00070000 cf900000
> GPR08: 00000000 cf900004 40000000 c8e52c4c c08d3190 1002801c 0fcf5000 c0ab85f8
> GPR16: d0d1f7a0 c12a9080 00000001 df7b7f80 00000003 cf900000 e1bc0000 e1ccb988
> GPR24: ffffffff c8ed0000 e1cc0220 00000000 c8ec0000 c8ec0000 c8ec0f50 c8ec0000
> NIP [e209290c] ath12k_dp_tx_completion_handler+0x22c/0x720 [ath12k]
> LR [e2092854] ath12k_dp_tx_completion_handler+0x174/0x720 [ath12k]
> Call Trace:
> [dffe3e30] [e2092854] ath12k_dp_tx_completion_handler+0x174/0x720 [ath12k] (unreliable)
> [dffe3e80] [e208fe18] ath12k_dp_service_srng+0x58/0x380 [ath12k]
> [dffe3ed0] [e20a1490] ath12k_pci_hif_resume+0x520/0x8a0 [ath12k]
> [dffe3f00] [c067404c] __napi_poll+0x4c/0x260
> [dffe3f30] [c06746f8] net_rx_action+0x188/0x340
> [dffe3fa0] [c003a3d8] handle_softirqs+0x128/0x280
> [dffe3ff0] [c00045b0] do_softirq_own_stack+0x30/0x50
> [d0f2fb70] [00000000] 0x0
> [d0f2fb90] [c003a7d0] irq_exit+0x70/0xa0
> [d0f2fba0] [c0000c84] ExternalInput+0x144/0x160
> --- interrupt: 500 at percpu_counter_add_batch+0x9c/0x150
> NIP: c0425e8c LR: c01a5964 CTR: c01764e0
> REGS: d0f2fbb0 TRAP: 0500 Tainted: G O (6.6.73)
> MSR: 00029002 <CE,EE,ME> CR: 48008802 XER: 20000000
>
> GPR00: c01a5a00 d0f2fca0 c328a500 c1db7300 dffc0f20 00000000 fffffffc 00021002
> GPR08: 1e763000 e1091054 00000007 c12b0530 88002808 1002801c 0fcf5000 c0ab85f8
> GPR16: d0d1f7a0 dffc0f20 00000000 000003fe 00000000 f92412bd 00000003 c9525480
> GPR24: d0f2fd74 c8a501f8 c12b0530 00029002 00000007 00000000 0000000b c1db7300
> NIP [c0425e8c] percpu_counter_add_batch+0x9c/0x150
> LR [c01a5964] unmap_page_range+0x484/0x820
> --- interrupt: 500
> [d0f2fca0] [00000001] 0x1 (unreliable)
> [d0f2fcd0] [c01a5a00] unmap_page_range+0x520/0x820
> [d0f2fd60] [c01a5d9c] unmap_vmas+0x9c/0xe0
> [d0f2fda0] [c01afef4] exit_mmap+0xb4/0x2a0
> [d0f2fe40] [c0031610] mmput+0x40/0x140
> [d0f2fe60] [c0038df4] do_exit+0x2b4/0x990
> [d0f2feb0] [c00396c4] do_group_exit+0x34/0xa0
> [d0f2fed0] [c0039748] sys_exit_group+0x18/0x20
> [d0f2fee0] [c000dbac] system_call_exception+0xac/0x1f0
> [d0f2ff00] [c00110e8] ret_from_syscall+0x0/0x28
> --- interrupt: c00 at 0xfded438
> NIP: 0fded438 LR: 0ff23958 CTR: 0fd94930
> REGS: d0f2ff10 TRAP: 0c00 Tainted: G O (6.6.73)
> MSR: 0002f902 <CE,EE,PR,FP,ME> CR: 28002402 XER: 20000000
>
> GPR00: 000000ea bff93390 b0316520 00000000 113e8af0 113e8af0 00000000 00000000
> GPR08: 00000000 00000000 00000000 ffffffff b02ccb04 1002801c 100a0000 bfbc4260
> GPR16: 114974b0 00000000 114a4de0 00000000 b02cc900 00000001 00000000 00000001
> GPR24: 0ff239a0 00000000 00000001 00000000 b030f52c fffff000 0ff23958 00000000
> NIP [0fded438] 0xfded438
> LR [0ff23958] 0xff23958
> --- interrupt: c00
> Code: 512a421e 2e140000 512a463e 40f20008 555b9f3e 39350004 754a4000 7c804c2c 41c20224 7c87442c 2c040000 41c20230 <88a40011> 7fc3f378 83a40008 8a640010
> ---[ end trace 0000000000000000 ]---
>
> Kernel panic - not syncing: Fatal exception
> ---[ end Kernel panic - not syncing: Fatal exception ]---
>
>
> user@root:~# Kernel attempted to read user page (c011de) - exploit attempt? (uid: 0)
> BUG: Unable to handle kernel data access on read at 0x00c011de
> Faulting instruction address: 0xe1e3dc44
> Oops: Kernel access of bad area, sig: 11 [#1]
> BE PAGE_SIZE=4K SMP NR_CPUS=4 CoreNet Generic
> Modules linked in: ...
> CPU: 1 PID: 0 Comm: swapper/1 Tainted: G O 6.6.73 #0
> Hardware name: CyBoxAP-A e5500 0x80241021 CoreNet Generic
> NIP: e1e3dc44 LR: e1e3dc30 CTR: c08d40e0
> REGS: dffe3ce0 TRAP: 0300 Tainted: G O (6.6.73)
> MSR: 00029002 <CE,EE,ME> CR: 44004402 XER: 00000000
> DEAR: 00c011de ESR: 00000000
> GPR00: e1e33154 dffe3dd0 c1870000 00000000 cebe0000 00000000 00000000 00c011ce
> GPR08: 00000001 00000000 00020000 c30a294c c08d40e0 00000000 00000001 00000000
> GPR16: e1ce2668 c9270000 c9269a18 c92664d0 e1ce26dc 00000000 babababa dffe3df4
> GPR24: 00000040 00000000 c9266480 dffe3dec dffe3e04 c9260000 00c011ce c9269a18
> NIP [e1e3dc44] ath12k_dp_rx_process_wbm_err+0x124/0x600 [ath12k]
> LR [e1e3dc30] ath12k_dp_rx_process_wbm_err+0x110/0x600 [ath12k]
> Call Trace:
> [dffe3dd0] [c0ab8e30] 0xc0ab8e30 (unreliable)
> [dffe3e80] [e1e33154] ath12k_dp_service_srng+0x314/0x380 [ath12k]
> [dffe3ed0] [e1e44540] ath12k_pci_hif_resume+0x520/0x8a0 [ath12k]
> [dffe3f00] [c0674c7c] __napi_poll+0x4c/0x260
> [dffe3f30] [c0675328] net_rx_action+0x188/0x340
> [dffe3fa0] [c003a3d8] handle_softirqs+0x128/0x280
> [dffe3ff0] [c00045b0] do_softirq_own_stack+0x30/0x50
> [c18c7e10] [c12b040c] 0xc12b040c
> [c18c7e30] [c003a7d0] irq_exit+0x70/0xa0
> [c18c7e40] [c0000c84] ExternalInput+0x144/0x160
> --- interrupt: 500 at arch_cpu_idle+0x24/0x50
> NIP: c00071f4 LR: c00071f4 CTR: c000fe14
> REGS: c18c7e50 TRAP: 0500 Tainted: G O (6.6.73)
> MSR: 0002b002 <CE,EE,FP,ME> CR: 84000402 XER: 00000000
>
> GPR00: c08cc978 c18c7f40 c1870000 00000005 00000001 40000000 c328becc c12b0530
> GPR08: c12b0530 c000fe14 0098ca91 00154674 24000402 00000000 00000001 00000000
> GPR16: 00000000 00000000 c00119a0 dffee5f0 00000001 00000000 ffffffff c1050254
> GPR24: c12c0000 c0011970 c0011940 c12d0000 00000004 c12b040c c12b0000 00000001
> NIP [c00071f4] arch_cpu_idle+0x24/0x50
> LR [c00071f4] arch_cpu_idle+0x24/0x50
> --- interrupt: 500
> [c18c7f40] [c0a367e0] 0xc0a367e0 (unreliable)
> [c18c7f50] [c08cc978] default_idle_call+0x38/0x58
> [c18c7f60] [c007b3b0] do_idle+0xf0/0x130
> [c18c7f80] [c007b580] cpu_startup_entry+0x30/0x40
> [c18c7fa0] [c001325c] start_secondary+0x48c/0x930
> [c18c7ff0] [c0002870] __secondary_start+0x90/0xdc
> Code: 7fa3eb78 4bfcba59 7c641b79 41c20144 38a10044 7fa3eb78 4bfcdb85 7c651b79 40c2026c 83c10058 2c1e0000 41c202d0 <813e0010> 7c09b000 41c20010 7e84a378
> ---[ end trace 0000000000000000 ]---
>
> Kernel panic - not syncing: Fatal exception
> ---[ end Kernel panic - not syncing: Fatal exception ]---
>
>
> My fix, as shown in the patch below, is to remove the conversion. But then the
> member variables `buf_va_lo` and `buf_va_hi` must be `u32`, which is obviously
> wrong. Alternatively, `desc_va` must be `__le64`, but that is likely also
> incorrect, because the address is simply dereferenced, and this clearly requires
> CPU endianness. What I also do not fully understand is who actually fills these
> addresses and at which stage this happens. I hope you can help clarify this so
> that I can provide a correct patch for this issue afterward.
>
>
hmm, i am not sure here, but can you please try
diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c
index 1c82d927d27b..f142759a217b 100644
--- a/drivers/net/wireless/ath/ath12k/dp.c
+++ b/drivers/net/wireless/ath/ath12k/dp.c
@@ -1246,7 +1246,7 @@ static int ath12k_dp_cc_desc_init(struct ath12k_base *ab)
/* Update descriptor VA in SPT */
rx_desc_addr = ath12k_dp_cc_get_desc_addr_ptr(dp, ppt_idx, j);
- *rx_desc_addr = &rx_descs[j];
+ *rx_desc_addr = (struct ath12k_rx_desc_info
*)cpu_to_le64(&rx_descs[j]);
}
}
@@ -1286,7 +1286,7 @@ static int ath12k_dp_cc_desc_init(struct ath12k_base *ab)
/* Update descriptor VA in SPT */
tx_desc_addr =
ath12k_dp_cc_get_desc_addr_ptr(dp, ppt_idx, j);
- *tx_desc_addr = &tx_descs[j];
+ *tx_desc_addr = (struct ath12k_tx_desc_info
*)cpu_to_le64(&tx_descs[j]);
}
}
spin_unlock_bh(&dp->tx_desc_lock[pool_id]);
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: ath12k: desc_va endianness problem
2026-03-23 9:31 ` Baochen Qiang
@ 2026-03-23 11:20 ` Alexander Wilhelm
2026-03-25 2:46 ` Baochen Qiang
0 siblings, 1 reply; 5+ messages in thread
From: Alexander Wilhelm @ 2026-03-23 11:20 UTC (permalink / raw)
To: Baochen Qiang; +Cc: Jeff Johnson, ath12k, linux-wireless, linux-kernel
On Mon, Mar 23, 2026 at 05:31:03PM +0800, Baochen Qiang wrote:
>
>
> On 3/20/2026 5:52 PM, Alexander Wilhelm wrote:
> > Hello ath12k developers,
> >
> > I have another fix for the big endian platform, but unfortunately the data types
> > do not match here, so I need your support. The problem is the following: the
> > structs `hal_reo_dest_ring`, `hal_wbm_completion_ring`, and
> > `hal_wbm_release_ring_cc_rx` all define the members `buf_va_lo` and `buf_va_hi`
> > as `__le32`. At first glance this seems correct, because the entire structure
> > contains only little endian fields. The local variable `desc_va` in each
> > function (see patch below) is of type `u64`, so it makes sense that I would need
> > to convert from little endian to CPU endian. Unfortunately, this leads to the
> > following crashes, in `tx_completion` and `rx_process_wbm`, respectivally:
> >
> >
> > Kernel attempted to read user page (40dcdf) - exploit attempt? (uid: 0)
> > BUG: Unable to handle kernel data access on read at 0x0040dcdf
> > Faulting instruction address: 0xe209290c
> > Oops: Kernel access of bad area, sig: 11 [#1]
> > BE PAGE_SIZE=4K SMP NR_CPUS=4 CoreNet Generic
> > Modules linked in: ath12k(O) mac80211(O) cfg80211(O) compat(O) ...
> > CPU: 1 PID: 10200 Comm: jshn Tainted: G O 6.6.73 #0
> > Hardware name: CyBoxAP-A e5500 0x80241021 CoreNet Generic
> > NIP: e209290c LR: e2092854 CTR: c08d3190
> > REGS: dffe3d40 TRAP: 0300 Tainted: G O (6.6.73)
> > MSR: 00029002 <CE,EE,ME> CR: 44004804 XER: 00000000
> > DEAR: 0040dcdf ESR: 00000000
> > GPR00: e2092854 dffe3e30 c328a500 e2092854 0040dcce 00000008 00070000 cf900000
> > GPR08: 00000000 cf900004 40000000 c8e52c4c c08d3190 1002801c 0fcf5000 c0ab85f8
> > GPR16: d0d1f7a0 c12a9080 00000001 df7b7f80 00000003 cf900000 e1bc0000 e1ccb988
> > GPR24: ffffffff c8ed0000 e1cc0220 00000000 c8ec0000 c8ec0000 c8ec0f50 c8ec0000
> > NIP [e209290c] ath12k_dp_tx_completion_handler+0x22c/0x720 [ath12k]
> > LR [e2092854] ath12k_dp_tx_completion_handler+0x174/0x720 [ath12k]
> > Call Trace:
> > [dffe3e30] [e2092854] ath12k_dp_tx_completion_handler+0x174/0x720 [ath12k] (unreliable)
> > [dffe3e80] [e208fe18] ath12k_dp_service_srng+0x58/0x380 [ath12k]
> > [dffe3ed0] [e20a1490] ath12k_pci_hif_resume+0x520/0x8a0 [ath12k]
> > [dffe3f00] [c067404c] __napi_poll+0x4c/0x260
> > [dffe3f30] [c06746f8] net_rx_action+0x188/0x340
> > [dffe3fa0] [c003a3d8] handle_softirqs+0x128/0x280
> > [dffe3ff0] [c00045b0] do_softirq_own_stack+0x30/0x50
> > [d0f2fb70] [00000000] 0x0
> > [d0f2fb90] [c003a7d0] irq_exit+0x70/0xa0
> > [d0f2fba0] [c0000c84] ExternalInput+0x144/0x160
> > --- interrupt: 500 at percpu_counter_add_batch+0x9c/0x150
> > NIP: c0425e8c LR: c01a5964 CTR: c01764e0
> > REGS: d0f2fbb0 TRAP: 0500 Tainted: G O (6.6.73)
> > MSR: 00029002 <CE,EE,ME> CR: 48008802 XER: 20000000
> >
> > GPR00: c01a5a00 d0f2fca0 c328a500 c1db7300 dffc0f20 00000000 fffffffc 00021002
> > GPR08: 1e763000 e1091054 00000007 c12b0530 88002808 1002801c 0fcf5000 c0ab85f8
> > GPR16: d0d1f7a0 dffc0f20 00000000 000003fe 00000000 f92412bd 00000003 c9525480
> > GPR24: d0f2fd74 c8a501f8 c12b0530 00029002 00000007 00000000 0000000b c1db7300
> > NIP [c0425e8c] percpu_counter_add_batch+0x9c/0x150
> > LR [c01a5964] unmap_page_range+0x484/0x820
> > --- interrupt: 500
> > [d0f2fca0] [00000001] 0x1 (unreliable)
> > [d0f2fcd0] [c01a5a00] unmap_page_range+0x520/0x820
> > [d0f2fd60] [c01a5d9c] unmap_vmas+0x9c/0xe0
> > [d0f2fda0] [c01afef4] exit_mmap+0xb4/0x2a0
> > [d0f2fe40] [c0031610] mmput+0x40/0x140
> > [d0f2fe60] [c0038df4] do_exit+0x2b4/0x990
> > [d0f2feb0] [c00396c4] do_group_exit+0x34/0xa0
> > [d0f2fed0] [c0039748] sys_exit_group+0x18/0x20
> > [d0f2fee0] [c000dbac] system_call_exception+0xac/0x1f0
> > [d0f2ff00] [c00110e8] ret_from_syscall+0x0/0x28
> > --- interrupt: c00 at 0xfded438
> > NIP: 0fded438 LR: 0ff23958 CTR: 0fd94930
> > REGS: d0f2ff10 TRAP: 0c00 Tainted: G O (6.6.73)
> > MSR: 0002f902 <CE,EE,PR,FP,ME> CR: 28002402 XER: 20000000
> >
> > GPR00: 000000ea bff93390 b0316520 00000000 113e8af0 113e8af0 00000000 00000000
> > GPR08: 00000000 00000000 00000000 ffffffff b02ccb04 1002801c 100a0000 bfbc4260
> > GPR16: 114974b0 00000000 114a4de0 00000000 b02cc900 00000001 00000000 00000001
> > GPR24: 0ff239a0 00000000 00000001 00000000 b030f52c fffff000 0ff23958 00000000
> > NIP [0fded438] 0xfded438
> > LR [0ff23958] 0xff23958
> > --- interrupt: c00
> > Code: 512a421e 2e140000 512a463e 40f20008 555b9f3e 39350004 754a4000 7c804c2c 41c20224 7c87442c 2c040000 41c20230 <88a40011> 7fc3f378 83a40008 8a640010
> > ---[ end trace 0000000000000000 ]---
> >
> > Kernel panic - not syncing: Fatal exception
> > ---[ end Kernel panic - not syncing: Fatal exception ]---
> >
> >
> > user@root:~# Kernel attempted to read user page (c011de) - exploit attempt? (uid: 0)
> > BUG: Unable to handle kernel data access on read at 0x00c011de
> > Faulting instruction address: 0xe1e3dc44
> > Oops: Kernel access of bad area, sig: 11 [#1]
> > BE PAGE_SIZE=4K SMP NR_CPUS=4 CoreNet Generic
> > Modules linked in: ...
> > CPU: 1 PID: 0 Comm: swapper/1 Tainted: G O 6.6.73 #0
> > Hardware name: CyBoxAP-A e5500 0x80241021 CoreNet Generic
> > NIP: e1e3dc44 LR: e1e3dc30 CTR: c08d40e0
> > REGS: dffe3ce0 TRAP: 0300 Tainted: G O (6.6.73)
> > MSR: 00029002 <CE,EE,ME> CR: 44004402 XER: 00000000
> > DEAR: 00c011de ESR: 00000000
> > GPR00: e1e33154 dffe3dd0 c1870000 00000000 cebe0000 00000000 00000000 00c011ce
> > GPR08: 00000001 00000000 00020000 c30a294c c08d40e0 00000000 00000001 00000000
> > GPR16: e1ce2668 c9270000 c9269a18 c92664d0 e1ce26dc 00000000 babababa dffe3df4
> > GPR24: 00000040 00000000 c9266480 dffe3dec dffe3e04 c9260000 00c011ce c9269a18
> > NIP [e1e3dc44] ath12k_dp_rx_process_wbm_err+0x124/0x600 [ath12k]
> > LR [e1e3dc30] ath12k_dp_rx_process_wbm_err+0x110/0x600 [ath12k]
> > Call Trace:
> > [dffe3dd0] [c0ab8e30] 0xc0ab8e30 (unreliable)
> > [dffe3e80] [e1e33154] ath12k_dp_service_srng+0x314/0x380 [ath12k]
> > [dffe3ed0] [e1e44540] ath12k_pci_hif_resume+0x520/0x8a0 [ath12k]
> > [dffe3f00] [c0674c7c] __napi_poll+0x4c/0x260
> > [dffe3f30] [c0675328] net_rx_action+0x188/0x340
> > [dffe3fa0] [c003a3d8] handle_softirqs+0x128/0x280
> > [dffe3ff0] [c00045b0] do_softirq_own_stack+0x30/0x50
> > [c18c7e10] [c12b040c] 0xc12b040c
> > [c18c7e30] [c003a7d0] irq_exit+0x70/0xa0
> > [c18c7e40] [c0000c84] ExternalInput+0x144/0x160
> > --- interrupt: 500 at arch_cpu_idle+0x24/0x50
> > NIP: c00071f4 LR: c00071f4 CTR: c000fe14
> > REGS: c18c7e50 TRAP: 0500 Tainted: G O (6.6.73)
> > MSR: 0002b002 <CE,EE,FP,ME> CR: 84000402 XER: 00000000
> >
> > GPR00: c08cc978 c18c7f40 c1870000 00000005 00000001 40000000 c328becc c12b0530
> > GPR08: c12b0530 c000fe14 0098ca91 00154674 24000402 00000000 00000001 00000000
> > GPR16: 00000000 00000000 c00119a0 dffee5f0 00000001 00000000 ffffffff c1050254
> > GPR24: c12c0000 c0011970 c0011940 c12d0000 00000004 c12b040c c12b0000 00000001
> > NIP [c00071f4] arch_cpu_idle+0x24/0x50
> > LR [c00071f4] arch_cpu_idle+0x24/0x50
> > --- interrupt: 500
> > [c18c7f40] [c0a367e0] 0xc0a367e0 (unreliable)
> > [c18c7f50] [c08cc978] default_idle_call+0x38/0x58
> > [c18c7f60] [c007b3b0] do_idle+0xf0/0x130
> > [c18c7f80] [c007b580] cpu_startup_entry+0x30/0x40
> > [c18c7fa0] [c001325c] start_secondary+0x48c/0x930
> > [c18c7ff0] [c0002870] __secondary_start+0x90/0xdc
> > Code: 7fa3eb78 4bfcba59 7c641b79 41c20144 38a10044 7fa3eb78 4bfcdb85 7c651b79 40c2026c 83c10058 2c1e0000 41c202d0 <813e0010> 7c09b000 41c20010 7e84a378
> > ---[ end trace 0000000000000000 ]---
> >
> > Kernel panic - not syncing: Fatal exception
> > ---[ end Kernel panic - not syncing: Fatal exception ]---
> >
> >
> > My fix, as shown in the patch below, is to remove the conversion. But then the
> > member variables `buf_va_lo` and `buf_va_hi` must be `u32`, which is obviously
> > wrong. Alternatively, `desc_va` must be `__le64`, but that is likely also
> > incorrect, because the address is simply dereferenced, and this clearly requires
> > CPU endianness. What I also do not fully understand is who actually fills these
> > addresses and at which stage this happens. I hope you can help clarify this so
> > that I can provide a correct patch for this issue afterward.
> >
> >
>
> hmm, i am not sure here, but can you please try
>
> diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c
> index 1c82d927d27b..f142759a217b 100644
> --- a/drivers/net/wireless/ath/ath12k/dp.c
> +++ b/drivers/net/wireless/ath/ath12k/dp.c
> @@ -1246,7 +1246,7 @@ static int ath12k_dp_cc_desc_init(struct ath12k_base *ab)
>
> /* Update descriptor VA in SPT */
> rx_desc_addr = ath12k_dp_cc_get_desc_addr_ptr(dp, ppt_idx, j);
> - *rx_desc_addr = &rx_descs[j];
> + *rx_desc_addr = (struct ath12k_rx_desc_info
> *)cpu_to_le64(&rx_descs[j]);
> }
> }
>
> @@ -1286,7 +1286,7 @@ static int ath12k_dp_cc_desc_init(struct ath12k_base *ab)
> /* Update descriptor VA in SPT */
> tx_desc_addr =
> ath12k_dp_cc_get_desc_addr_ptr(dp, ppt_idx, j);
> - *tx_desc_addr = &tx_descs[j];
> + *tx_desc_addr = (struct ath12k_tx_desc_info
> *)cpu_to_le64(&tx_descs[j]);
> }
> }
> spin_unlock_bh(&dp->tx_desc_lock[pool_id]);
>
Hi Baochen,
It actually worked, although the solution isn't entirely clean. Sparse
consequently complains with:
dp.c:1249:42: warning: cast from restricted __le64
dp.c:1289:50: warning: cast from restricted __le64
To be honest, I also don't quite understand why the struct pointer has to be in
little endian at this point. The function `ath12k_dp_cc_get_desc_addr_ptr`
returns an offset from the `vaddr` inside the `spt_info` struct, stored as a
`u64`. But dereferencing it suddenly treats it as little endian. Shouldn't
`vaddr` itself perhaps be a `__le64`?
Best regards
Alexander Wilhelm
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: ath12k: desc_va endianness problem
2026-03-23 11:20 ` Alexander Wilhelm
@ 2026-03-25 2:46 ` Baochen Qiang
2026-03-25 12:59 ` Alexander Wilhelm
0 siblings, 1 reply; 5+ messages in thread
From: Baochen Qiang @ 2026-03-25 2:46 UTC (permalink / raw)
To: Alexander Wilhelm; +Cc: Jeff Johnson, ath12k, linux-wireless, linux-kernel
On 3/23/2026 7:20 PM, Alexander Wilhelm wrote:
> On Mon, Mar 23, 2026 at 05:31:03PM +0800, Baochen Qiang wrote:
>>
>>
>> On 3/20/2026 5:52 PM, Alexander Wilhelm wrote:
>>> Hello ath12k developers,
>>>
>>> I have another fix for the big endian platform, but unfortunately the data types
>>> do not match here, so I need your support. The problem is the following: the
>>> structs `hal_reo_dest_ring`, `hal_wbm_completion_ring`, and
>>> `hal_wbm_release_ring_cc_rx` all define the members `buf_va_lo` and `buf_va_hi`
>>> as `__le32`. At first glance this seems correct, because the entire structure
>>> contains only little endian fields. The local variable `desc_va` in each
>>> function (see patch below) is of type `u64`, so it makes sense that I would need
>>> to convert from little endian to CPU endian. Unfortunately, this leads to the
>>> following crashes, in `tx_completion` and `rx_process_wbm`, respectivally:
>>>
>>>
>>> Kernel attempted to read user page (40dcdf) - exploit attempt? (uid: 0)
>>> BUG: Unable to handle kernel data access on read at 0x0040dcdf
>>> Faulting instruction address: 0xe209290c
>>> Oops: Kernel access of bad area, sig: 11 [#1]
>>> BE PAGE_SIZE=4K SMP NR_CPUS=4 CoreNet Generic
>>> Modules linked in: ath12k(O) mac80211(O) cfg80211(O) compat(O) ...
>>> CPU: 1 PID: 10200 Comm: jshn Tainted: G O 6.6.73 #0
>>> Hardware name: CyBoxAP-A e5500 0x80241021 CoreNet Generic
>>> NIP: e209290c LR: e2092854 CTR: c08d3190
>>> REGS: dffe3d40 TRAP: 0300 Tainted: G O (6.6.73)
>>> MSR: 00029002 <CE,EE,ME> CR: 44004804 XER: 00000000
>>> DEAR: 0040dcdf ESR: 00000000
>>> GPR00: e2092854 dffe3e30 c328a500 e2092854 0040dcce 00000008 00070000 cf900000
>>> GPR08: 00000000 cf900004 40000000 c8e52c4c c08d3190 1002801c 0fcf5000 c0ab85f8
>>> GPR16: d0d1f7a0 c12a9080 00000001 df7b7f80 00000003 cf900000 e1bc0000 e1ccb988
>>> GPR24: ffffffff c8ed0000 e1cc0220 00000000 c8ec0000 c8ec0000 c8ec0f50 c8ec0000
>>> NIP [e209290c] ath12k_dp_tx_completion_handler+0x22c/0x720 [ath12k]
>>> LR [e2092854] ath12k_dp_tx_completion_handler+0x174/0x720 [ath12k]
>>> Call Trace:
>>> [dffe3e30] [e2092854] ath12k_dp_tx_completion_handler+0x174/0x720 [ath12k] (unreliable)
>>> [dffe3e80] [e208fe18] ath12k_dp_service_srng+0x58/0x380 [ath12k]
>>> [dffe3ed0] [e20a1490] ath12k_pci_hif_resume+0x520/0x8a0 [ath12k]
>>> [dffe3f00] [c067404c] __napi_poll+0x4c/0x260
>>> [dffe3f30] [c06746f8] net_rx_action+0x188/0x340
>>> [dffe3fa0] [c003a3d8] handle_softirqs+0x128/0x280
>>> [dffe3ff0] [c00045b0] do_softirq_own_stack+0x30/0x50
>>> [d0f2fb70] [00000000] 0x0
>>> [d0f2fb90] [c003a7d0] irq_exit+0x70/0xa0
>>> [d0f2fba0] [c0000c84] ExternalInput+0x144/0x160
>>> --- interrupt: 500 at percpu_counter_add_batch+0x9c/0x150
>>> NIP: c0425e8c LR: c01a5964 CTR: c01764e0
>>> REGS: d0f2fbb0 TRAP: 0500 Tainted: G O (6.6.73)
>>> MSR: 00029002 <CE,EE,ME> CR: 48008802 XER: 20000000
>>>
>>> GPR00: c01a5a00 d0f2fca0 c328a500 c1db7300 dffc0f20 00000000 fffffffc 00021002
>>> GPR08: 1e763000 e1091054 00000007 c12b0530 88002808 1002801c 0fcf5000 c0ab85f8
>>> GPR16: d0d1f7a0 dffc0f20 00000000 000003fe 00000000 f92412bd 00000003 c9525480
>>> GPR24: d0f2fd74 c8a501f8 c12b0530 00029002 00000007 00000000 0000000b c1db7300
>>> NIP [c0425e8c] percpu_counter_add_batch+0x9c/0x150
>>> LR [c01a5964] unmap_page_range+0x484/0x820
>>> --- interrupt: 500
>>> [d0f2fca0] [00000001] 0x1 (unreliable)
>>> [d0f2fcd0] [c01a5a00] unmap_page_range+0x520/0x820
>>> [d0f2fd60] [c01a5d9c] unmap_vmas+0x9c/0xe0
>>> [d0f2fda0] [c01afef4] exit_mmap+0xb4/0x2a0
>>> [d0f2fe40] [c0031610] mmput+0x40/0x140
>>> [d0f2fe60] [c0038df4] do_exit+0x2b4/0x990
>>> [d0f2feb0] [c00396c4] do_group_exit+0x34/0xa0
>>> [d0f2fed0] [c0039748] sys_exit_group+0x18/0x20
>>> [d0f2fee0] [c000dbac] system_call_exception+0xac/0x1f0
>>> [d0f2ff00] [c00110e8] ret_from_syscall+0x0/0x28
>>> --- interrupt: c00 at 0xfded438
>>> NIP: 0fded438 LR: 0ff23958 CTR: 0fd94930
>>> REGS: d0f2ff10 TRAP: 0c00 Tainted: G O (6.6.73)
>>> MSR: 0002f902 <CE,EE,PR,FP,ME> CR: 28002402 XER: 20000000
>>>
>>> GPR00: 000000ea bff93390 b0316520 00000000 113e8af0 113e8af0 00000000 00000000
>>> GPR08: 00000000 00000000 00000000 ffffffff b02ccb04 1002801c 100a0000 bfbc4260
>>> GPR16: 114974b0 00000000 114a4de0 00000000 b02cc900 00000001 00000000 00000001
>>> GPR24: 0ff239a0 00000000 00000001 00000000 b030f52c fffff000 0ff23958 00000000
>>> NIP [0fded438] 0xfded438
>>> LR [0ff23958] 0xff23958
>>> --- interrupt: c00
>>> Code: 512a421e 2e140000 512a463e 40f20008 555b9f3e 39350004 754a4000 7c804c2c 41c20224 7c87442c 2c040000 41c20230 <88a40011> 7fc3f378 83a40008 8a640010
>>> ---[ end trace 0000000000000000 ]---
>>>
>>> Kernel panic - not syncing: Fatal exception
>>> ---[ end Kernel panic - not syncing: Fatal exception ]---
>>>
>>>
>>> user@root:~# Kernel attempted to read user page (c011de) - exploit attempt? (uid: 0)
>>> BUG: Unable to handle kernel data access on read at 0x00c011de
>>> Faulting instruction address: 0xe1e3dc44
>>> Oops: Kernel access of bad area, sig: 11 [#1]
>>> BE PAGE_SIZE=4K SMP NR_CPUS=4 CoreNet Generic
>>> Modules linked in: ...
>>> CPU: 1 PID: 0 Comm: swapper/1 Tainted: G O 6.6.73 #0
>>> Hardware name: CyBoxAP-A e5500 0x80241021 CoreNet Generic
>>> NIP: e1e3dc44 LR: e1e3dc30 CTR: c08d40e0
>>> REGS: dffe3ce0 TRAP: 0300 Tainted: G O (6.6.73)
>>> MSR: 00029002 <CE,EE,ME> CR: 44004402 XER: 00000000
>>> DEAR: 00c011de ESR: 00000000
>>> GPR00: e1e33154 dffe3dd0 c1870000 00000000 cebe0000 00000000 00000000 00c011ce
>>> GPR08: 00000001 00000000 00020000 c30a294c c08d40e0 00000000 00000001 00000000
>>> GPR16: e1ce2668 c9270000 c9269a18 c92664d0 e1ce26dc 00000000 babababa dffe3df4
>>> GPR24: 00000040 00000000 c9266480 dffe3dec dffe3e04 c9260000 00c011ce c9269a18
>>> NIP [e1e3dc44] ath12k_dp_rx_process_wbm_err+0x124/0x600 [ath12k]
>>> LR [e1e3dc30] ath12k_dp_rx_process_wbm_err+0x110/0x600 [ath12k]
>>> Call Trace:
>>> [dffe3dd0] [c0ab8e30] 0xc0ab8e30 (unreliable)
>>> [dffe3e80] [e1e33154] ath12k_dp_service_srng+0x314/0x380 [ath12k]
>>> [dffe3ed0] [e1e44540] ath12k_pci_hif_resume+0x520/0x8a0 [ath12k]
>>> [dffe3f00] [c0674c7c] __napi_poll+0x4c/0x260
>>> [dffe3f30] [c0675328] net_rx_action+0x188/0x340
>>> [dffe3fa0] [c003a3d8] handle_softirqs+0x128/0x280
>>> [dffe3ff0] [c00045b0] do_softirq_own_stack+0x30/0x50
>>> [c18c7e10] [c12b040c] 0xc12b040c
>>> [c18c7e30] [c003a7d0] irq_exit+0x70/0xa0
>>> [c18c7e40] [c0000c84] ExternalInput+0x144/0x160
>>> --- interrupt: 500 at arch_cpu_idle+0x24/0x50
>>> NIP: c00071f4 LR: c00071f4 CTR: c000fe14
>>> REGS: c18c7e50 TRAP: 0500 Tainted: G O (6.6.73)
>>> MSR: 0002b002 <CE,EE,FP,ME> CR: 84000402 XER: 00000000
>>>
>>> GPR00: c08cc978 c18c7f40 c1870000 00000005 00000001 40000000 c328becc c12b0530
>>> GPR08: c12b0530 c000fe14 0098ca91 00154674 24000402 00000000 00000001 00000000
>>> GPR16: 00000000 00000000 c00119a0 dffee5f0 00000001 00000000 ffffffff c1050254
>>> GPR24: c12c0000 c0011970 c0011940 c12d0000 00000004 c12b040c c12b0000 00000001
>>> NIP [c00071f4] arch_cpu_idle+0x24/0x50
>>> LR [c00071f4] arch_cpu_idle+0x24/0x50
>>> --- interrupt: 500
>>> [c18c7f40] [c0a367e0] 0xc0a367e0 (unreliable)
>>> [c18c7f50] [c08cc978] default_idle_call+0x38/0x58
>>> [c18c7f60] [c007b3b0] do_idle+0xf0/0x130
>>> [c18c7f80] [c007b580] cpu_startup_entry+0x30/0x40
>>> [c18c7fa0] [c001325c] start_secondary+0x48c/0x930
>>> [c18c7ff0] [c0002870] __secondary_start+0x90/0xdc
>>> Code: 7fa3eb78 4bfcba59 7c641b79 41c20144 38a10044 7fa3eb78 4bfcdb85 7c651b79 40c2026c 83c10058 2c1e0000 41c202d0 <813e0010> 7c09b000 41c20010 7e84a378
>>> ---[ end trace 0000000000000000 ]---
>>>
>>> Kernel panic - not syncing: Fatal exception
>>> ---[ end Kernel panic - not syncing: Fatal exception ]---
>>>
>>>
>>> My fix, as shown in the patch below, is to remove the conversion. But then the
>>> member variables `buf_va_lo` and `buf_va_hi` must be `u32`, which is obviously
>>> wrong. Alternatively, `desc_va` must be `__le64`, but that is likely also
>>> incorrect, because the address is simply dereferenced, and this clearly requires
>>> CPU endianness. What I also do not fully understand is who actually fills these
>>> addresses and at which stage this happens. I hope you can help clarify this so
>>> that I can provide a correct patch for this issue afterward.
>>>
>>>
>>
>> hmm, i am not sure here, but can you please try
>>
>> diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c
>> index 1c82d927d27b..f142759a217b 100644
>> --- a/drivers/net/wireless/ath/ath12k/dp.c
>> +++ b/drivers/net/wireless/ath/ath12k/dp.c
>> @@ -1246,7 +1246,7 @@ static int ath12k_dp_cc_desc_init(struct ath12k_base *ab)
>>
>> /* Update descriptor VA in SPT */
>> rx_desc_addr = ath12k_dp_cc_get_desc_addr_ptr(dp, ppt_idx, j);
>> - *rx_desc_addr = &rx_descs[j];
>> + *rx_desc_addr = (struct ath12k_rx_desc_info
>> *)cpu_to_le64(&rx_descs[j]);
>> }
>> }
>>
>> @@ -1286,7 +1286,7 @@ static int ath12k_dp_cc_desc_init(struct ath12k_base *ab)
>> /* Update descriptor VA in SPT */
>> tx_desc_addr =
>> ath12k_dp_cc_get_desc_addr_ptr(dp, ppt_idx, j);
>> - *tx_desc_addr = &tx_descs[j];
>> + *tx_desc_addr = (struct ath12k_tx_desc_info
>> *)cpu_to_le64(&tx_descs[j]);
>> }
>> }
>> spin_unlock_bh(&dp->tx_desc_lock[pool_id]);
>>
>
> Hi Baochen,
>
> It actually worked, although the solution isn't entirely clean. Sparse
> consequently complains with:
>
> dp.c:1249:42: warning: cast from restricted __le64
> dp.c:1289:50: warning: cast from restricted __le64
>
> To be honest, I also don't quite understand why the struct pointer has to be in
> little endian at this point. The function `ath12k_dp_cc_get_desc_addr_ptr`
> returns an offset from the `vaddr` inside the `spt_info` struct, stored as a
> `u64`. But dereferencing it suddenly treats it as little endian. Shouldn't
> `vaddr` itself perhaps be a `__le64`?
that piece of memory is for direct access by the target, so yes I think 'vaddr' should be
defined as __le64.
>
>
> Best regards
> Alexander Wilhelm
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: ath12k: desc_va endianness problem
2026-03-25 2:46 ` Baochen Qiang
@ 2026-03-25 12:59 ` Alexander Wilhelm
0 siblings, 0 replies; 5+ messages in thread
From: Alexander Wilhelm @ 2026-03-25 12:59 UTC (permalink / raw)
To: Baochen Qiang; +Cc: Jeff Johnson, ath12k, linux-wireless, linux-kernel
On Wed, Mar 25, 2026 at 10:46:10AM +0800, Baochen Qiang wrote:
>
>
> On 3/23/2026 7:20 PM, Alexander Wilhelm wrote:
> > On Mon, Mar 23, 2026 at 05:31:03PM +0800, Baochen Qiang wrote:
> >>
> >>
> >> On 3/20/2026 5:52 PM, Alexander Wilhelm wrote:
> >>> Hello ath12k developers,
> >>>
> >>> I have another fix for the big endian platform, but unfortunately the data types
> >>> do not match here, so I need your support. The problem is the following: the
> >>> structs `hal_reo_dest_ring`, `hal_wbm_completion_ring`, and
> >>> `hal_wbm_release_ring_cc_rx` all define the members `buf_va_lo` and `buf_va_hi`
> >>> as `__le32`. At first glance this seems correct, because the entire structure
> >>> contains only little endian fields. The local variable `desc_va` in each
> >>> function (see patch below) is of type `u64`, so it makes sense that I would need
> >>> to convert from little endian to CPU endian. Unfortunately, this leads to the
> >>> following crashes, in `tx_completion` and `rx_process_wbm`, respectivally:
> >>>
> >>>
> >>> Kernel attempted to read user page (40dcdf) - exploit attempt? (uid: 0)
> >>> BUG: Unable to handle kernel data access on read at 0x0040dcdf
> >>> Faulting instruction address: 0xe209290c
> >>> Oops: Kernel access of bad area, sig: 11 [#1]
> >>> BE PAGE_SIZE=4K SMP NR_CPUS=4 CoreNet Generic
> >>> Modules linked in: ath12k(O) mac80211(O) cfg80211(O) compat(O) ...
> >>> CPU: 1 PID: 10200 Comm: jshn Tainted: G O 6.6.73 #0
> >>> Hardware name: CyBoxAP-A e5500 0x80241021 CoreNet Generic
> >>> NIP: e209290c LR: e2092854 CTR: c08d3190
> >>> REGS: dffe3d40 TRAP: 0300 Tainted: G O (6.6.73)
> >>> MSR: 00029002 <CE,EE,ME> CR: 44004804 XER: 00000000
> >>> DEAR: 0040dcdf ESR: 00000000
> >>> GPR00: e2092854 dffe3e30 c328a500 e2092854 0040dcce 00000008 00070000 cf900000
> >>> GPR08: 00000000 cf900004 40000000 c8e52c4c c08d3190 1002801c 0fcf5000 c0ab85f8
> >>> GPR16: d0d1f7a0 c12a9080 00000001 df7b7f80 00000003 cf900000 e1bc0000 e1ccb988
> >>> GPR24: ffffffff c8ed0000 e1cc0220 00000000 c8ec0000 c8ec0000 c8ec0f50 c8ec0000
> >>> NIP [e209290c] ath12k_dp_tx_completion_handler+0x22c/0x720 [ath12k]
> >>> LR [e2092854] ath12k_dp_tx_completion_handler+0x174/0x720 [ath12k]
> >>> Call Trace:
> >>> [dffe3e30] [e2092854] ath12k_dp_tx_completion_handler+0x174/0x720 [ath12k] (unreliable)
> >>> [dffe3e80] [e208fe18] ath12k_dp_service_srng+0x58/0x380 [ath12k]
> >>> [dffe3ed0] [e20a1490] ath12k_pci_hif_resume+0x520/0x8a0 [ath12k]
> >>> [dffe3f00] [c067404c] __napi_poll+0x4c/0x260
> >>> [dffe3f30] [c06746f8] net_rx_action+0x188/0x340
> >>> [dffe3fa0] [c003a3d8] handle_softirqs+0x128/0x280
> >>> [dffe3ff0] [c00045b0] do_softirq_own_stack+0x30/0x50
> >>> [d0f2fb70] [00000000] 0x0
> >>> [d0f2fb90] [c003a7d0] irq_exit+0x70/0xa0
> >>> [d0f2fba0] [c0000c84] ExternalInput+0x144/0x160
> >>> --- interrupt: 500 at percpu_counter_add_batch+0x9c/0x150
> >>> NIP: c0425e8c LR: c01a5964 CTR: c01764e0
> >>> REGS: d0f2fbb0 TRAP: 0500 Tainted: G O (6.6.73)
> >>> MSR: 00029002 <CE,EE,ME> CR: 48008802 XER: 20000000
> >>>
> >>> GPR00: c01a5a00 d0f2fca0 c328a500 c1db7300 dffc0f20 00000000 fffffffc 00021002
> >>> GPR08: 1e763000 e1091054 00000007 c12b0530 88002808 1002801c 0fcf5000 c0ab85f8
> >>> GPR16: d0d1f7a0 dffc0f20 00000000 000003fe 00000000 f92412bd 00000003 c9525480
> >>> GPR24: d0f2fd74 c8a501f8 c12b0530 00029002 00000007 00000000 0000000b c1db7300
> >>> NIP [c0425e8c] percpu_counter_add_batch+0x9c/0x150
> >>> LR [c01a5964] unmap_page_range+0x484/0x820
> >>> --- interrupt: 500
> >>> [d0f2fca0] [00000001] 0x1 (unreliable)
> >>> [d0f2fcd0] [c01a5a00] unmap_page_range+0x520/0x820
> >>> [d0f2fd60] [c01a5d9c] unmap_vmas+0x9c/0xe0
> >>> [d0f2fda0] [c01afef4] exit_mmap+0xb4/0x2a0
> >>> [d0f2fe40] [c0031610] mmput+0x40/0x140
> >>> [d0f2fe60] [c0038df4] do_exit+0x2b4/0x990
> >>> [d0f2feb0] [c00396c4] do_group_exit+0x34/0xa0
> >>> [d0f2fed0] [c0039748] sys_exit_group+0x18/0x20
> >>> [d0f2fee0] [c000dbac] system_call_exception+0xac/0x1f0
> >>> [d0f2ff00] [c00110e8] ret_from_syscall+0x0/0x28
> >>> --- interrupt: c00 at 0xfded438
> >>> NIP: 0fded438 LR: 0ff23958 CTR: 0fd94930
> >>> REGS: d0f2ff10 TRAP: 0c00 Tainted: G O (6.6.73)
> >>> MSR: 0002f902 <CE,EE,PR,FP,ME> CR: 28002402 XER: 20000000
> >>>
> >>> GPR00: 000000ea bff93390 b0316520 00000000 113e8af0 113e8af0 00000000 00000000
> >>> GPR08: 00000000 00000000 00000000 ffffffff b02ccb04 1002801c 100a0000 bfbc4260
> >>> GPR16: 114974b0 00000000 114a4de0 00000000 b02cc900 00000001 00000000 00000001
> >>> GPR24: 0ff239a0 00000000 00000001 00000000 b030f52c fffff000 0ff23958 00000000
> >>> NIP [0fded438] 0xfded438
> >>> LR [0ff23958] 0xff23958
> >>> --- interrupt: c00
> >>> Code: 512a421e 2e140000 512a463e 40f20008 555b9f3e 39350004 754a4000 7c804c2c 41c20224 7c87442c 2c040000 41c20230 <88a40011> 7fc3f378 83a40008 8a640010
> >>> ---[ end trace 0000000000000000 ]---
> >>>
> >>> Kernel panic - not syncing: Fatal exception
> >>> ---[ end Kernel panic - not syncing: Fatal exception ]---
> >>>
> >>>
> >>> user@root:~# Kernel attempted to read user page (c011de) - exploit attempt? (uid: 0)
> >>> BUG: Unable to handle kernel data access on read at 0x00c011de
> >>> Faulting instruction address: 0xe1e3dc44
> >>> Oops: Kernel access of bad area, sig: 11 [#1]
> >>> BE PAGE_SIZE=4K SMP NR_CPUS=4 CoreNet Generic
> >>> Modules linked in: ...
> >>> CPU: 1 PID: 0 Comm: swapper/1 Tainted: G O 6.6.73 #0
> >>> Hardware name: CyBoxAP-A e5500 0x80241021 CoreNet Generic
> >>> NIP: e1e3dc44 LR: e1e3dc30 CTR: c08d40e0
> >>> REGS: dffe3ce0 TRAP: 0300 Tainted: G O (6.6.73)
> >>> MSR: 00029002 <CE,EE,ME> CR: 44004402 XER: 00000000
> >>> DEAR: 00c011de ESR: 00000000
> >>> GPR00: e1e33154 dffe3dd0 c1870000 00000000 cebe0000 00000000 00000000 00c011ce
> >>> GPR08: 00000001 00000000 00020000 c30a294c c08d40e0 00000000 00000001 00000000
> >>> GPR16: e1ce2668 c9270000 c9269a18 c92664d0 e1ce26dc 00000000 babababa dffe3df4
> >>> GPR24: 00000040 00000000 c9266480 dffe3dec dffe3e04 c9260000 00c011ce c9269a18
> >>> NIP [e1e3dc44] ath12k_dp_rx_process_wbm_err+0x124/0x600 [ath12k]
> >>> LR [e1e3dc30] ath12k_dp_rx_process_wbm_err+0x110/0x600 [ath12k]
> >>> Call Trace:
> >>> [dffe3dd0] [c0ab8e30] 0xc0ab8e30 (unreliable)
> >>> [dffe3e80] [e1e33154] ath12k_dp_service_srng+0x314/0x380 [ath12k]
> >>> [dffe3ed0] [e1e44540] ath12k_pci_hif_resume+0x520/0x8a0 [ath12k]
> >>> [dffe3f00] [c0674c7c] __napi_poll+0x4c/0x260
> >>> [dffe3f30] [c0675328] net_rx_action+0x188/0x340
> >>> [dffe3fa0] [c003a3d8] handle_softirqs+0x128/0x280
> >>> [dffe3ff0] [c00045b0] do_softirq_own_stack+0x30/0x50
> >>> [c18c7e10] [c12b040c] 0xc12b040c
> >>> [c18c7e30] [c003a7d0] irq_exit+0x70/0xa0
> >>> [c18c7e40] [c0000c84] ExternalInput+0x144/0x160
> >>> --- interrupt: 500 at arch_cpu_idle+0x24/0x50
> >>> NIP: c00071f4 LR: c00071f4 CTR: c000fe14
> >>> REGS: c18c7e50 TRAP: 0500 Tainted: G O (6.6.73)
> >>> MSR: 0002b002 <CE,EE,FP,ME> CR: 84000402 XER: 00000000
> >>>
> >>> GPR00: c08cc978 c18c7f40 c1870000 00000005 00000001 40000000 c328becc c12b0530
> >>> GPR08: c12b0530 c000fe14 0098ca91 00154674 24000402 00000000 00000001 00000000
> >>> GPR16: 00000000 00000000 c00119a0 dffee5f0 00000001 00000000 ffffffff c1050254
> >>> GPR24: c12c0000 c0011970 c0011940 c12d0000 00000004 c12b040c c12b0000 00000001
> >>> NIP [c00071f4] arch_cpu_idle+0x24/0x50
> >>> LR [c00071f4] arch_cpu_idle+0x24/0x50
> >>> --- interrupt: 500
> >>> [c18c7f40] [c0a367e0] 0xc0a367e0 (unreliable)
> >>> [c18c7f50] [c08cc978] default_idle_call+0x38/0x58
> >>> [c18c7f60] [c007b3b0] do_idle+0xf0/0x130
> >>> [c18c7f80] [c007b580] cpu_startup_entry+0x30/0x40
> >>> [c18c7fa0] [c001325c] start_secondary+0x48c/0x930
> >>> [c18c7ff0] [c0002870] __secondary_start+0x90/0xdc
> >>> Code: 7fa3eb78 4bfcba59 7c641b79 41c20144 38a10044 7fa3eb78 4bfcdb85 7c651b79 40c2026c 83c10058 2c1e0000 41c202d0 <813e0010> 7c09b000 41c20010 7e84a378
> >>> ---[ end trace 0000000000000000 ]---
> >>>
> >>> Kernel panic - not syncing: Fatal exception
> >>> ---[ end Kernel panic - not syncing: Fatal exception ]---
> >>>
> >>>
> >>> My fix, as shown in the patch below, is to remove the conversion. But then the
> >>> member variables `buf_va_lo` and `buf_va_hi` must be `u32`, which is obviously
> >>> wrong. Alternatively, `desc_va` must be `__le64`, but that is likely also
> >>> incorrect, because the address is simply dereferenced, and this clearly requires
> >>> CPU endianness. What I also do not fully understand is who actually fills these
> >>> addresses and at which stage this happens. I hope you can help clarify this so
> >>> that I can provide a correct patch for this issue afterward.
> >>>
> >>>
> >>
> >> hmm, i am not sure here, but can you please try
> >>
> >> diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c
> >> index 1c82d927d27b..f142759a217b 100644
> >> --- a/drivers/net/wireless/ath/ath12k/dp.c
> >> +++ b/drivers/net/wireless/ath/ath12k/dp.c
> >> @@ -1246,7 +1246,7 @@ static int ath12k_dp_cc_desc_init(struct ath12k_base *ab)
> >>
> >> /* Update descriptor VA in SPT */
> >> rx_desc_addr = ath12k_dp_cc_get_desc_addr_ptr(dp, ppt_idx, j);
> >> - *rx_desc_addr = &rx_descs[j];
> >> + *rx_desc_addr = (struct ath12k_rx_desc_info
> >> *)cpu_to_le64(&rx_descs[j]);
> >> }
> >> }
> >>
> >> @@ -1286,7 +1286,7 @@ static int ath12k_dp_cc_desc_init(struct ath12k_base *ab)
> >> /* Update descriptor VA in SPT */
> >> tx_desc_addr =
> >> ath12k_dp_cc_get_desc_addr_ptr(dp, ppt_idx, j);
> >> - *tx_desc_addr = &tx_descs[j];
> >> + *tx_desc_addr = (struct ath12k_tx_desc_info
> >> *)cpu_to_le64(&tx_descs[j]);
> >> }
> >> }
> >> spin_unlock_bh(&dp->tx_desc_lock[pool_id]);
> >>
> >
> > Hi Baochen,
> >
> > It actually worked, although the solution isn't entirely clean. Sparse
> > consequently complains with:
> >
> > dp.c:1249:42: warning: cast from restricted __le64
> > dp.c:1289:50: warning: cast from restricted __le64
> >
> > To be honest, I also don't quite understand why the struct pointer has to be in
> > little endian at this point. The function `ath12k_dp_cc_get_desc_addr_ptr`
> > returns an offset from the `vaddr` inside the `spt_info` struct, stored as a
> > `u64`. But dereferencing it suddenly treats it as little endian. Shouldn't
> > `vaddr` itself perhaps be a `__le64`?
>
> that piece of memory is for direct access by the target, so yes I think 'vaddr' should be
> defined as __le64.
Thanks again, Baochen. I've prepared a patch now, and it's working. I'll send it
shortly.
Best regards
Alexander Wilhelm
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-03-25 13:00 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-20 9:52 ath12k: desc_va endianness problem Alexander Wilhelm
2026-03-23 9:31 ` Baochen Qiang
2026-03-23 11:20 ` Alexander Wilhelm
2026-03-25 2:46 ` Baochen Qiang
2026-03-25 12:59 ` Alexander Wilhelm
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox