Re: ath12k: desc_va endianness problem

[Baochen Qiang <baochen.qiang@oss.qualcomm.com>]

On 3/20/2026 5:52 PM, Alexander Wilhelm wrote:
> Hello ath12k developers,
> 
> I have another fix for the big endian platform, but unfortunately the data types
> do not match here, so I need your support. The problem is the following: the
> structs `hal_reo_dest_ring`, `hal_wbm_completion_ring`, and
> `hal_wbm_release_ring_cc_rx` all define the members `buf_va_lo` and `buf_va_hi`
> as `__le32`. At first glance this seems correct, because the entire structure
> contains only little endian fields. The local variable `desc_va` in each
> function (see patch below) is of type `u64`, so it makes sense that I would need
> to convert from little endian to CPU endian. Unfortunately, this leads to the
> following crashes, in `tx_completion` and `rx_process_wbm`, respectivally:
> 
> 
>     Kernel attempted to read user page (40dcdf) - exploit attempt? (uid: 0)
>     BUG: Unable to handle kernel data access on read at 0x0040dcdf
>     Faulting instruction address: 0xe209290c
>     Oops: Kernel access of bad area, sig: 11 [#1]
>     BE PAGE_SIZE=4K SMP NR_CPUS=4 CoreNet Generic
>     Modules linked in: ath12k(O) mac80211(O) cfg80211(O) compat(O) ...
>     CPU: 1 PID: 10200 Comm: jshn Tainted: G           O       6.6.73 #0
>     Hardware name: CyBoxAP-A e5500 0x80241021 CoreNet Generic
>     NIP:  e209290c LR: e2092854 CTR: c08d3190
>     REGS: dffe3d40 TRAP: 0300   Tainted: G           O        (6.6.73)
>     MSR:  00029002 <CE,EE,ME>  CR: 44004804  XER: 00000000
>     DEAR: 0040dcdf ESR: 00000000 
>     GPR00: e2092854 dffe3e30 c328a500 e2092854 0040dcce 00000008 00070000 cf900000 
>     GPR08: 00000000 cf900004 40000000 c8e52c4c c08d3190 1002801c 0fcf5000 c0ab85f8 
>     GPR16: d0d1f7a0 c12a9080 00000001 df7b7f80 00000003 cf900000 e1bc0000 e1ccb988 
>     GPR24: ffffffff c8ed0000 e1cc0220 00000000 c8ec0000 c8ec0000 c8ec0f50 c8ec0000 
>     NIP [e209290c] ath12k_dp_tx_completion_handler+0x22c/0x720 [ath12k]
>     LR [e2092854] ath12k_dp_tx_completion_handler+0x174/0x720 [ath12k]
>     Call Trace:
>     [dffe3e30] [e2092854] ath12k_dp_tx_completion_handler+0x174/0x720 [ath12k] (unreliable)
>     [dffe3e80] [e208fe18] ath12k_dp_service_srng+0x58/0x380 [ath12k]
>     [dffe3ed0] [e20a1490] ath12k_pci_hif_resume+0x520/0x8a0 [ath12k]
>     [dffe3f00] [c067404c] __napi_poll+0x4c/0x260
>     [dffe3f30] [c06746f8] net_rx_action+0x188/0x340
>     [dffe3fa0] [c003a3d8] handle_softirqs+0x128/0x280
>     [dffe3ff0] [c00045b0] do_softirq_own_stack+0x30/0x50
>     [d0f2fb70] [00000000] 0x0
>     [d0f2fb90] [c003a7d0] irq_exit+0x70/0xa0
>     [d0f2fba0] [c0000c84] ExternalInput+0x144/0x160
>     --- interrupt: 500 at percpu_counter_add_batch+0x9c/0x150
>     NIP:  c0425e8c LR: c01a5964 CTR: c01764e0
>     REGS: d0f2fbb0 TRAP: 0500   Tainted: G           O        (6.6.73)
>     MSR:  00029002 <CE,EE,ME>  CR: 48008802  XER: 20000000
> 
>     GPR00: c01a5a00 d0f2fca0 c328a500 c1db7300 dffc0f20 00000000 fffffffc 00021002 
>     GPR08: 1e763000 e1091054 00000007 c12b0530 88002808 1002801c 0fcf5000 c0ab85f8 
>     GPR16: d0d1f7a0 dffc0f20 00000000 000003fe 00000000 f92412bd 00000003 c9525480 
>     GPR24: d0f2fd74 c8a501f8 c12b0530 00029002 00000007 00000000 0000000b c1db7300 
>     NIP [c0425e8c] percpu_counter_add_batch+0x9c/0x150
>     LR [c01a5964] unmap_page_range+0x484/0x820
>     --- interrupt: 500
>     [d0f2fca0] [00000001] 0x1 (unreliable)
>     [d0f2fcd0] [c01a5a00] unmap_page_range+0x520/0x820
>     [d0f2fd60] [c01a5d9c] unmap_vmas+0x9c/0xe0
>     [d0f2fda0] [c01afef4] exit_mmap+0xb4/0x2a0
>     [d0f2fe40] [c0031610] mmput+0x40/0x140
>     [d0f2fe60] [c0038df4] do_exit+0x2b4/0x990
>     [d0f2feb0] [c00396c4] do_group_exit+0x34/0xa0
>     [d0f2fed0] [c0039748] sys_exit_group+0x18/0x20
>     [d0f2fee0] [c000dbac] system_call_exception+0xac/0x1f0
>     [d0f2ff00] [c00110e8] ret_from_syscall+0x0/0x28
>     --- interrupt: c00 at 0xfded438
>     NIP:  0fded438 LR: 0ff23958 CTR: 0fd94930
>     REGS: d0f2ff10 TRAP: 0c00   Tainted: G           O        (6.6.73)
>     MSR:  0002f902 <CE,EE,PR,FP,ME>  CR: 28002402  XER: 20000000
> 
>     GPR00: 000000ea bff93390 b0316520 00000000 113e8af0 113e8af0 00000000 00000000 
>     GPR08: 00000000 00000000 00000000 ffffffff b02ccb04 1002801c 100a0000 bfbc4260 
>     GPR16: 114974b0 00000000 114a4de0 00000000 b02cc900 00000001 00000000 00000001 
>     GPR24: 0ff239a0 00000000 00000001 00000000 b030f52c fffff000 0ff23958 00000000 
>     NIP [0fded438] 0xfded438
>     LR [0ff23958] 0xff23958
>     --- interrupt: c00
>     Code: 512a421e 2e140000 512a463e 40f20008 555b9f3e 39350004 754a4000 7c804c2c 41c20224 7c87442c 2c040000 41c20230 <88a40011> 7fc3f378 83a40008 8a640010
>     ---[ end trace 0000000000000000 ]---
> 
>     Kernel panic - not syncing: Fatal exception
>     ---[ end Kernel panic - not syncing: Fatal exception ]---
> 
> 
>     user@root:~# Kernel attempted to read user page (c011de) - exploit attempt? (uid: 0)
>     BUG: Unable to handle kernel data access on read at 0x00c011de
>     Faulting instruction address: 0xe1e3dc44
>     Oops: Kernel access of bad area, sig: 11 [#1]
>     BE PAGE_SIZE=4K SMP NR_CPUS=4 CoreNet Generic
>     Modules linked in: ...
>     CPU: 1 PID: 0 Comm: swapper/1 Tainted: G           O       6.6.73 #0
>     Hardware name: CyBoxAP-A e5500 0x80241021 CoreNet Generic
>     NIP:  e1e3dc44 LR: e1e3dc30 CTR: c08d40e0
>     REGS: dffe3ce0 TRAP: 0300   Tainted: G           O        (6.6.73)
>     MSR:  00029002 <CE,EE,ME>  CR: 44004402  XER: 00000000
>     DEAR: 00c011de ESR: 00000000 
>     GPR00: e1e33154 dffe3dd0 c1870000 00000000 cebe0000 00000000 00000000 00c011ce 
>     GPR08: 00000001 00000000 00020000 c30a294c c08d40e0 00000000 00000001 00000000 
>     GPR16: e1ce2668 c9270000 c9269a18 c92664d0 e1ce26dc 00000000 babababa dffe3df4 
>     GPR24: 00000040 00000000 c9266480 dffe3dec dffe3e04 c9260000 00c011ce c9269a18 
>     NIP [e1e3dc44] ath12k_dp_rx_process_wbm_err+0x124/0x600 [ath12k]
>     LR [e1e3dc30] ath12k_dp_rx_process_wbm_err+0x110/0x600 [ath12k]
>     Call Trace:
>     [dffe3dd0] [c0ab8e30] 0xc0ab8e30 (unreliable)
>     [dffe3e80] [e1e33154] ath12k_dp_service_srng+0x314/0x380 [ath12k]
>     [dffe3ed0] [e1e44540] ath12k_pci_hif_resume+0x520/0x8a0 [ath12k]
>     [dffe3f00] [c0674c7c] __napi_poll+0x4c/0x260
>     [dffe3f30] [c0675328] net_rx_action+0x188/0x340
>     [dffe3fa0] [c003a3d8] handle_softirqs+0x128/0x280
>     [dffe3ff0] [c00045b0] do_softirq_own_stack+0x30/0x50
>     [c18c7e10] [c12b040c] 0xc12b040c
>     [c18c7e30] [c003a7d0] irq_exit+0x70/0xa0
>     [c18c7e40] [c0000c84] ExternalInput+0x144/0x160
>     --- interrupt: 500 at arch_cpu_idle+0x24/0x50
>     NIP:  c00071f4 LR: c00071f4 CTR: c000fe14
>     REGS: c18c7e50 TRAP: 0500   Tainted: G           O        (6.6.73)
>     MSR:  0002b002 <CE,EE,FP,ME>  CR: 84000402  XER: 00000000
> 
>     GPR00: c08cc978 c18c7f40 c1870000 00000005 00000001 40000000 c328becc c12b0530 
>     GPR08: c12b0530 c000fe14 0098ca91 00154674 24000402 00000000 00000001 00000000 
>     GPR16: 00000000 00000000 c00119a0 dffee5f0 00000001 00000000 ffffffff c1050254 
>     GPR24: c12c0000 c0011970 c0011940 c12d0000 00000004 c12b040c c12b0000 00000001 
>     NIP [c00071f4] arch_cpu_idle+0x24/0x50
>     LR [c00071f4] arch_cpu_idle+0x24/0x50
>     --- interrupt: 500
>     [c18c7f40] [c0a367e0] 0xc0a367e0 (unreliable)
>     [c18c7f50] [c08cc978] default_idle_call+0x38/0x58
>     [c18c7f60] [c007b3b0] do_idle+0xf0/0x130
>     [c18c7f80] [c007b580] cpu_startup_entry+0x30/0x40
>     [c18c7fa0] [c001325c] start_secondary+0x48c/0x930
>     [c18c7ff0] [c0002870] __secondary_start+0x90/0xdc
>     Code: 7fa3eb78 4bfcba59 7c641b79 41c20144 38a10044 7fa3eb78 4bfcdb85 7c651b79 40c2026c 83c10058 2c1e0000 41c202d0 <813e0010> 7c09b000 41c20010 7e84a378
>     ---[ end trace 0000000000000000 ]---
> 
>     Kernel panic - not syncing: Fatal exception
>     ---[ end Kernel panic - not syncing: Fatal exception ]---
> 
> 
> My fix, as shown in the patch below, is to remove the conversion. But then the
> member variables `buf_va_lo` and `buf_va_hi` must be `u32`, which is obviously
> wrong. Alternatively, `desc_va` must be `__le64`, but that is likely also
> incorrect, because the address is simply dereferenced, and this clearly requires
> CPU endianness. What I also do not fully understand is who actually fills these
> addresses and at which stage this happens. I hope you can help clarify this so
> that I can provide a correct patch for this issue afterward.
> 
> 

hmm, i am not sure here, but can you please try

diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c
index 1c82d927d27b..f142759a217b 100644
--- a/drivers/net/wireless/ath/ath12k/dp.c
+++ b/drivers/net/wireless/ath/ath12k/dp.c
@@ -1246,7 +1246,7 @@ static int ath12k_dp_cc_desc_init(struct ath12k_base *ab)

                        /* Update descriptor VA in SPT */
                        rx_desc_addr = ath12k_dp_cc_get_desc_addr_ptr(dp, ppt_idx, j);
-                       *rx_desc_addr = &rx_descs[j];
+                       *rx_desc_addr = (struct ath12k_rx_desc_info
*)cpu_to_le64(&rx_descs[j]);
                }
        }

@@ -1286,7 +1286,7 @@ static int ath12k_dp_cc_desc_init(struct ath12k_base *ab)
                                /* Update descriptor VA in SPT */
                                tx_desc_addr =
                                        ath12k_dp_cc_get_desc_addr_ptr(dp, ppt_idx, j);
-                               *tx_desc_addr = &tx_descs[j];
+                               *tx_desc_addr = (struct ath12k_tx_desc_info
*)cpu_to_le64(&tx_descs[j]);
                        }
                }
                spin_unlock_bh(&dp->tx_desc_lock[pool_id]);