Re: [PATCH v2] ath12k: fix NULL pointer dereference in rhash table destroy

[Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>]

On 7/5/2026 10:53 PM, Vasanthakumar Thiagarajan wrote:
> 
> 
> On 6/15/2026 4:51 PM, Jose Ignacio Tornos Martinez wrote:
>> When unbinding the ath12k driver, kernel NULL pointer dereferences
>> occur in irq_work_sync() called from rhashtable_destroy().
>>
>> Two hash tables are affected:
>> 1. ath12k_link_sta hash table in ath12k_base
>> 2. ath12k_dp_link_peer hash table in ath12k_dp
>>
>> The issue happens because the destroy functions are called unconditionally
>> in cleanup paths, but the hash tables are only initialized late in their
>> respective init functions. If the device was never fully started or if the
>> init functions failed before initializing the hash tables, the pointers
>> will be NULL. The issues are always reproducible from a VM because the MSI
>> addressing initialization is failing.
>>
>> Call trace for ath12k_link_sta_rhash_tbl_destroy:
>>   RIP: irq_work_sync+0x1e/0x70
>>   rhashtable_destroy+0x12/0x60
>>   ath12k_link_sta_rhash_tbl_destroy+0x19/0x40 [ath12k]
>>   ath12k_core_stop+0xe/0x80 [ath12k]
>>   ath12k_core_hw_group_cleanup+0x6b/0xb0 [ath12k]
>>   ath12k_pci_remove+0x60/0x110 [ath12k]
>>
>> Call trace for ath12k_dp_link_peer_rhash_tbl_destroy:
>>   RIP: irq_work_sync+0x1e/0x70
>>   rhashtable_destroy+0x12/0x60
>>   ath12k_dp_link_peer_rhash_tbl_destroy+0x29/0x50 [ath12k]
>>   ath12k_dp_cmn_device_deinit+0x21/0x140 [ath12k]
>>   ath12k_core_hw_group_cleanup+0x6b/0xb0 [ath12k]
>>   ath12k_pci_remove+0x60/0x110 [ath12k]
>>
>> Fix this by adding NULL checks before calling rhashtable_destroy() in
>> both destroy functions.
>>
>> The NULL check approach was chosen because the rhashtable pointer
>> serves as the initialization state indicator. The init can fail at
>> various points, leaving some components uninitialized. Checking the
>> pointer directly is simpler than adding separate state flags that
>> would need synchronization.
>>
>> Fixes: 57ccca410237 ("wifi: ath12k: Add hash table for ath12k_link_sta in ath12k_base")
>> Fixes: a88cf5f71adf ("wifi: ath12k: Add hash table for ath12k_dp_link_peer")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
> 
> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>

Missed to mention that pls add wifi prefix to the patch title.