Skip to content

wifi: ath11k/ath12k: dp rx sanity checks for invalid length in error paths#564

Open
miaoqing-quic wants to merge 3 commits into
qualcomm-linux:qcom-6.18.yfrom
miaoqing-quic:fix-dp_rx_check_len
Open

wifi: ath11k/ath12k: dp rx sanity checks for invalid length in error paths#564
miaoqing-quic wants to merge 3 commits into
qualcomm-linux:qcom-6.18.yfrom
miaoqing-quic:fix-dp_rx_check_len

Conversation

@miaoqing-quic
Copy link
Copy Markdown
Contributor

@miaoqing-quic miaoqing-quic commented May 12, 2026

This patch series adds two defensive sanity checks in ath11k DP RX handling to prevent invalid memory access when hardware/descriptor contents are unexpected, especially in WBM error scenarios. Also resolved a memory leak for ath12k.

CRs-Fixed: 4482395

@miaoqing-quic
FROMLIST: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verif…
34a9599 
…y_tkip_mic()

In ath12k_wifi7_dp_rx_h_verify_tkip_mic(), the call to
ath12k_dp_rx_check_nwifi_hdr_len_valid() may return false when the
NWIFI header length is invalid, causing the function to abort early with
-EINVAL.

When this happens, the error propagates to
ath12k_wifi7_dp_rx_h_defrag(), which clears first_frag by setting it
to NULL. As a result, the corresponding MSDU is no longer referenced
by the defragmentation path and is never freed.

This leads to a memory leak for the affected MSDU on this error path.
Proper cleanup is required to ensure the MSDU is released when header
validation fails during TKIP MIC verification.

Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3

Fixes: 9a0dddf ("wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi")
Signed-off-by: Miaoqing Pan <miaoqing.pan@oss.qualcomm.com>
Link: https://lore.kernel.org/linux-wireless/20260512021108.2031651-1-miaoqing.pan@oss.qualcomm.com/
@miaoqing-quic
FROMLIST: wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_und…
3b7982e 
…ecap_nwifi

In certain cases, hardware might provide packets with a
length greater than the maximum native Wi-Fi header length.
This can lead to accessing and modifying fields in the header
within the ath11k_dp_rx_h_undecap_nwifi() function for the
DP_RX_DECAP_TYPE_NATIVE_WIFI decap type and
potentially result in invalid data access and memory corruption.

Kernel stack is corrupted in: ath11k_dp_rx_h_undecap+0x6b0/0x6b0 [ath11k]
Call trace:
 ath11k_dp_rx_h_mpdu+0x0/0x2e8 [ath11k]
 ath11k_dp_rx_h_mpdu+0x1e0/0x2e8 [ath11k]
 ath11k_dp_rx_wbm_err+0x1e0/0x450 [ath11k]
 ath11k_dp_rx_process_wbm_err+0x2fc/0x460 [ath11k]
 ath11k_dp_service_srng+0x2e0/0x348 [ath11k]

Add a sanity check before processing the SKB to prevent invalid
data access in the undecap native Wi-Fi function for the
DP_RX_DECAP_TYPE_NATIVE_WIFI decap type.

This adapted from the discussion/patch of the ath12k driver [1].

Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1

Link: https://lore.kernel.org/linux-wireless/20250211090302.4105141-1-tamizh.raja@oss.qualcomm.com/ # [1]
Signed-off-by: Miaoqing Pan <miaoqing.pan@oss.qualcomm.com>
Link: https://lore.kernel.org/linux-wireless/20260512022351.2033155-2-miaoqing.pan@oss.qualcomm.com/
@miaoqing-quic
FROMLIST: wifi: ath11k: add MSDU length validation for TKIP MIC error
0e37411 
In the WBM error path, while processing TKIP MIC errors, MSDU length
is fetched from the hal_rx_desc's msdu_end. This MSDU length is
directly passed to skb_put() without validation. In stress test
scenarios, the WBM error ring may receive invalid descriptors, which
could lead to an invalid MSDU length.

To fix this, add a check to drop the skb when the calculated MSDU
length is greater than the skb size.

This is adapted from the discussion/patch of the ath12k driver [1].

Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1

Link: https://lore.kernel.org/linux-wireless/20250416021903.3178962-1-nithyanantham.paramasivam@oss.qualcomm.com/ # [1]
Signed-off-by: Miaoqing Pan <miaoqing.pan@oss.qualcomm.com>
Link: https://lore.kernel.org/linux-wireless/20260512022351.2033155-3-miaoqing.pan@oss.qualcomm.com/
@qswat-orbit-external
Copy link
Copy Markdown

qswat-orbit-external Bot commented May 12, 2026

Merge Check Failed: No Change Task Found

No associated change tasks found for CR 4482395 on any of the following entities:

Entities:

  • kernel.qli.2.0

CR: 4482395

Please ensure the CR has a change task associated with at least one of the entities for this branch.

@qcomlnxci
Copy link
Copy Markdown

qcomlnxci commented May 12, 2026

Test Matrix

Test Case glymur-crd kaanapali-mtp lemans-evk monaco-evk qcs615-ride qcs6490-rb3gen2 qcs8300-ride qcs9100-ride-r3 sm8750-mtp x1e80100-crd
CPUFreq_Validation ◻️ ◻️ ◻️ ✅ Pass ◻️ ◻️ ◻️ ◻️ ◻️ ◻️
adsp_remoteproc ◻️ ◻️ ◻️ ✅ Pass ◻️ ◻️ ◻️ ◻️ ◻️ ◻️
cdsp_remoteproc ◻️ ◻️ ◻️ ✅ Pass ◻️ ◻️ ◻️ ◻️ ◻️ ◻️
gpdsp_remoteproc ◻️ ◻️ ◻️ ✅ Pass ◻️ ◻️ ◻️ ◻️ ◻️ ◻️

@qcomlnxci
Copy link
Copy Markdown

qcomlnxci commented May 12, 2026

Test jobs on 0e37411

@qcomlnxci
Copy link
Copy Markdown

qcomlnxci commented May 13, 2026

Test jobs on 0e37411

@qcomlnxci
Copy link
Copy Markdown

qcomlnxci commented May 13, 2026

Test Matrix

Test Case glymur-crd kaanapali-mtp lemans-evk monaco-evk qcs615-ride qcs6490-rb3gen2 qcs8300-ride qcs9100-ride-r3 sm8750-mtp x1e80100-crd
BT_FW_KMD_Service ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
BT_ON_OFF ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
BT_SCAN ◻️ ◻️ ◻️ ❌ Fail ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
CPUFreq_Validation ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
CPU_affinity ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
DSP_AudioPD ◻️ ◻️ ◻️ ✅ Pass ⚠️ skip ✅ Pass ◻️ ⚠️ skip ◻️ ◻️
Ethernet ◻️ ◻️ ◻️ ✅ Pass ⚠️ skip ⚠️ skip ◻️ ⚠️ skip ◻️ ◻️
Freq_Scaling ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
GIC ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
IPA ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
Interrupts ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
OpenCV ◻️ ◻️ ◻️ ⚠️ skip ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
PCIe ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
Probe_Failure_Check ◻️ ◻️ ◻️ ❌ Fail ❌ Fail ❌ Fail ◻️ ❌ Fail ◻️ ◻️
RMNET ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
UFS_Validation ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
USBHost ◻️ ◻️ ◻️ ✅ Pass ❌ Fail ❌ Fail ◻️ ❌ Fail ◻️ ◻️
WiFi_Firmware_Driver ◻️ ◻️ ◻️ ⚠️ skip ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
WiFi_OnOff ◻️ ◻️ ◻️ ❌ Fail ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
adsp_remoteproc ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ❌ Fail ◻️ ◻️
cdsp_remoteproc ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ❌ Fail ◻️ ◻️
gpdsp_remoteproc ◻️ ◻️ ◻️ ✅ Pass ⚠️ skip ⚠️ skip ◻️ ❌ Fail ◻️ ◻️
hotplug ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
irq ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
kaslr ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
pinctrl ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
qcom_hwrng ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
remoteproc ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ❌ Fail ◻️ ◻️
rngtest ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
shmbridge ◻️ ◻️ ◻️ ✅ Pass ❌ Fail ❌ Fail ◻️ ❌ Fail ◻️ ◻️
smmu ◻️ ◻️ ◻️ ✅ Pass ❌ Fail ✅ Pass ◻️ ❌ Fail ◻️ ◻️
watchdog ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
wpss_remoteproc ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️

1 similar comment
@qcomlnxci
Copy link
Copy Markdown

qcomlnxci commented May 13, 2026

Test Matrix

Test Case glymur-crd kaanapali-mtp lemans-evk monaco-evk qcs615-ride qcs6490-rb3gen2 qcs8300-ride qcs9100-ride-r3 sm8750-mtp x1e80100-crd
BT_FW_KMD_Service ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
BT_ON_OFF ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
BT_SCAN ◻️ ◻️ ◻️ ❌ Fail ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
CPUFreq_Validation ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
CPU_affinity ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
DSP_AudioPD ◻️ ◻️ ◻️ ✅ Pass ⚠️ skip ✅ Pass ◻️ ⚠️ skip ◻️ ◻️
Ethernet ◻️ ◻️ ◻️ ✅ Pass ⚠️ skip ⚠️ skip ◻️ ⚠️ skip ◻️ ◻️
Freq_Scaling ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
GIC ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
IPA ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
Interrupts ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
OpenCV ◻️ ◻️ ◻️ ⚠️ skip ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
PCIe ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
Probe_Failure_Check ◻️ ◻️ ◻️ ❌ Fail ❌ Fail ❌ Fail ◻️ ❌ Fail ◻️ ◻️
RMNET ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
UFS_Validation ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
USBHost ◻️ ◻️ ◻️ ✅ Pass ❌ Fail ❌ Fail ◻️ ❌ Fail ◻️ ◻️
WiFi_Firmware_Driver ◻️ ◻️ ◻️ ⚠️ skip ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
WiFi_OnOff ◻️ ◻️ ◻️ ❌ Fail ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
adsp_remoteproc ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ❌ Fail ◻️ ◻️
cdsp_remoteproc ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ❌ Fail ◻️ ◻️
gpdsp_remoteproc ◻️ ◻️ ◻️ ✅ Pass ⚠️ skip ⚠️ skip ◻️ ❌ Fail ◻️ ◻️
hotplug ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
irq ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
kaslr ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
pinctrl ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
qcom_hwrng ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
remoteproc ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ❌ Fail ◻️ ◻️
rngtest ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
shmbridge ◻️ ◻️ ◻️ ✅ Pass ❌ Fail ❌ Fail ◻️ ❌ Fail ◻️ ◻️
smmu ◻️ ◻️ ◻️ ✅ Pass ❌ Fail ✅ Pass ◻️ ❌ Fail ◻️ ◻️
watchdog ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
wpss_remoteproc ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️

@qcomlnxci
Copy link
Copy Markdown

qcomlnxci commented May 13, 2026

Test jobs on 0e37411

@qcomlnxci
Copy link
Copy Markdown

qcomlnxci commented May 13, 2026

Test jobs on 0e37411

@qcomlnxci
Copy link
Copy Markdown

qcomlnxci commented May 13, 2026

Test Matrix

Test Case glymur-crd kaanapali-mtp lemans-evk monaco-evk qcs615-ride qcs6490-rb3gen2 qcs8300-ride qcs9100-ride-r3 sm8750-mtp x1e80100-crd
BT_FW_KMD_Service ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
BT_ON_OFF ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
BT_SCAN ◻️ ◻️ ◻️ ❌ Fail ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
CPUFreq_Validation ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
CPU_affinity ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
DSP_AudioPD ◻️ ◻️ ◻️ ✅ Pass ⚠️ skip ✅ Pass ◻️ ⚠️ skip ◻️ ◻️
Ethernet ◻️ ◻️ ◻️ ✅ Pass ⚠️ skip ⚠️ skip ◻️ ⚠️ skip ◻️ ◻️
Freq_Scaling ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
GIC ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
IPA ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
Interrupts ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
OpenCV ◻️ ◻️ ◻️ ⚠️ skip ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
PCIe ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
Probe_Failure_Check ◻️ ◻️ ◻️ ❌ Fail ❌ Fail ❌ Fail ◻️ ❌ Fail ◻️ ◻️
RMNET ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
UFS_Validation ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
USBHost ◻️ ◻️ ◻️ ✅ Pass ❌ Fail ❌ Fail ◻️ ❌ Fail ◻️ ◻️
WiFi_Firmware_Driver ◻️ ◻️ ◻️ ⚠️ skip ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
WiFi_OnOff ◻️ ◻️ ◻️ ❌ Fail ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
adsp_remoteproc ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ❌ Fail ◻️ ◻️
cdsp_remoteproc ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ❌ Fail ◻️ ◻️
gpdsp_remoteproc ◻️ ◻️ ◻️ ✅ Pass ⚠️ skip ⚠️ skip ◻️ ❌ Fail ◻️ ◻️
hotplug ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
irq ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
kaslr ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
pinctrl ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
qcom_hwrng ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
remoteproc ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ❌ Fail ◻️ ◻️
rngtest ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
shmbridge ◻️ ◻️ ◻️ ✅ Pass ❌ Fail ❌ Fail ◻️ ❌ Fail ◻️ ◻️
smmu ◻️ ◻️ ◻️ ✅ Pass ❌ Fail ✅ Pass ◻️ ❌ Fail ◻️ ◻️
watchdog ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️
wpss_remoteproc ◻️ ◻️ ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️ ✅ Pass ◻️ ◻️

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@shashim-quic shashim-quic shashim-quic approved these changes

@ndechesne ndechesne Awaiting requested review from ndechesne ndechesne was automatically assigned from qualcomm-linux/qualcomm-kernel-maint

@quic-tingweiz quic-tingweiz Awaiting requested review from quic-tingweiz quic-tingweiz was automatically assigned from qualcomm-linux/qualcomm-kernel-maint

@sgaud-quic sgaud-quic Awaiting requested review from sgaud-quic sgaud-quic was automatically assigned from qualcomm-linux/qualcomm-kernel-maint

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@miaoqing-quic @qcomlnxci @shashim-quic