[5.10,312/563] ath11k: Fix crash caused by uninitialized TX ring

From: Baochen Qiang <bqiang@codeaurora.org>

From: Baochen Qiang <bqiang@codeaurora.org>

[ Upstream commit 273703ebdb01b6c5f1aaf4b98fb57b177609055c ]

Commit 31582373a4a8 ("ath11k: Change number of TCL rings to one for
QCA6390") avoids initializing the other entries of dp->tx_ring cause
the corresponding TX rings on QCA6390/WCN6855 are not used, but leaves
those ring masks in ath11k_hw_ring_mask_qca6390.tx unchanged. Normally
this is OK because we will only get interrupts from the first TX ring
on these chips and thus only the first entry of dp->tx_ring is involved.

In case of one MSI vector, all DP rings share the same IRQ. For each
interrupt, all rings have to be checked, which means the other entries
of dp->tx_ring are involved. However since they are not initialized,
system crashes.

Fix this issue by simply removing those ring masks.

crash stack:
[  102.907438] BUG: kernel NULL pointer dereference, address: 0000000000000028
[  102.907447] #PF: supervisor read access in kernel mode
[  102.907451] #PF: error_code(0x0000) - not-present page
[  102.907453] PGD 1081f0067 P4D 1081f0067 PUD 1081f1067 PMD 0
[  102.907460] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI
[  102.907465] CPU: 0 PID: 3511 Comm: apt-check Kdump: loaded Tainted: G            E     5.15.0-rc4-wt-ath+ #20
[  102.907470] Hardware name: AMD Celadon-RN/Celadon-RN, BIOS RCD1005E 10/08/2020
[  102.907472] RIP: 0010:ath11k_dp_tx_completion_handler+0x201/0x830 [ath11k]
[  102.907497] Code: 3c 24 4e 8d ac 37 10 04 00 00 4a 8d bc 37 68 04 00 00 48 89 3c 24 48 63 c8 89 83 84 18 00 00 48 c1 e1 05 48 03 8b 78 18 00 00 <8b> 51 08 89 d6 83 e6 07 89 74 24 24 83 fe 03 74 04 85 f6 75 63 41
[  102.907501] RSP: 0000:ffff9b7340003e08 EFLAGS: 00010202
[  102.907505] RAX: 0000000000000001 RBX: ffff8e21530c0100 RCX: 0000000000000020
[  102.907508] RDX: 0000000000000000 RSI: 00000000fffffe00 RDI: ffff8e21530c1938
[  102.907511] RBP: ffff8e21530c0000 R08: 0000000000000001 R09: 0000000000000000
[  102.907513] R10: ffff8e2145534c10 R11: 0000000000000001 R12: ffff8e21530c2938
[  102.907515] R13: ffff8e21530c18e0 R14: 0000000000000100 R15: ffff8e21530c2978
[  102.907518] FS:  00007f5d4297e740(0000) GS:ffff8e243d600000(0000) knlGS:0000000000000000
[  102.907521] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  102.907524] CR2: 0000000000000028 CR3: 00000001034ea000 CR4: 0000000000350ef0
[  102.907527] Call Trace:
[  102.907531]  <IRQ>
[  102.907537]  ath11k_dp_service_srng+0x5c/0x2f0 [ath11k]
[  102.907556]  ath11k_pci_ext_grp_napi_poll+0x21/0x70 [ath11k_pci]
[  102.907562]  __napi_poll+0x2c/0x160
[  102.907570]  net_rx_action+0x251/0x310
[  102.907576]  __do_softirq+0x107/0x2fc
[  102.907585]  irq_exit_rcu+0x74/0x90
[  102.907593]  common_interrupt+0x83/0xa0
[  102.907600]  </IRQ>
[  102.907601]  asm_common_interrupt+0x1e/0x40

Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1

Signed-off-by: Baochen Qiang <bqiang@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211026011605.58615-1-quic_bqiang@quicinc.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/hw.c | 2 --
 1 file changed, 2 deletions(-)

Message ID	20220124184035.222561707@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Baochen Qiang <bqiang@codeaurora.org>, Kalle Valo <kvalo@codeaurora.org>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.10 312/563] ath11k: Fix crash caused by uninitialized TX ring Date: Mon, 24 Jan 2022 19:41:17 +0100 Message-Id: <20220124184035.222561707@linuxfoundation.org> In-Reply-To: <20220124184024.407936072@linuxfoundation.org> References: <20220124184024.407936072@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,006/563] f2fs: fix to do sanity check in is_alive() [5.10,011/563] mtd: rawnand: davinci: Dont calculate ECC when reading page [5.10,016/563] tools/nolibc: i386: fix initial stack alignment [5.10,020/563] media: flexcop-usb: fix control-message timeouts [5.10,024/563] media: s2255: fix control-message timeouts [5.10,025/563] media: dib0700: fix undefined behavior in tuner shutdown [5.10,026/563] media: redrat3: fix control-message timeouts [5.10,027/563] media: pvrusb2: fix control-message timeouts [5.10,032/563] lkdtm: Fix content of section containing lkdtm_rodata_do_nothing() [5.10,036/563] PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller [5.10,042/563] Bluetooth: L2CAP: Fix not initializing sk_peer_pid [5.10,045/563] drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure [5.10,046/563] drm/panel: innolux-p079zca: Delete panel on attach() failure [5.10,048/563] drm/rockchip: dsi: Hold pm-runtime across bind/unbind [5.10,051/563] Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails [5.10,054/563] drm/vc4: hdmi: Set a default HSM rate [5.10,055/563] wcn36xx: ensure pairing of init_scan/finish_scan and start_scan/end_scan [5.10,060/563] wcn36xx: populate band before determining rate on RX [5.10,064/563] media: videobuf2: Fix the size printk format [5.10,067/563] media: atomisp: fix inverted logic in buffers_needed() [5.10,068/563] media: atomisp: do not use err var when checking port validity for ISP2400 [5.10,069/563] media: atomisp: fix inverted error check for ia_css_mipi_is_source_port_valid() [5.10,071/563] media: staging: media: atomisp: pci: Balance braces around conditional statements ... [5.10,077/563] media: aspeed: Update signal status immediately to ensure sane hw state [5.10,078/563] arm64: dts: amlogic: meson-g12: Fix GPU operating point table node name [5.10,082/563] fs: dlm: use sk->sk_socket instead of con->sock [5.10,085/563] Bluetooth: stop proccessing malicious adv data [5.10,089/563] tee: fix put order in teedev_close_context() [5.10,091/563] drm/vboxvideo: fix a NULL vs IS_ERR() check [5.10,094/563] crypto: qce - fix uaf on qce_ahash_register_one [5.10,096/563] mtd: hyperbus: rpc-if: fix bug in rpcif_hb_remove [5.10,097/563] ARM: dts: stm32: fix dtbs_check warning on ili9341 dts binding on stm32f429 disco [5.10,098/563] crypto: qat - fix spelling mistake: "messge" -> "message" [5.10,100/563] crypto: qat - make pfvf send message direction agnostic [5.10,101/563] crypto: qat - fix undetected PFVF timeout in ACK loop [5.10,102/563] ath11k: Use host CE parameters for CE interrupts configuration [5.10,104/563] tty: serial: atmel: Check return code of dmaengine_submit() [5.10,105/563] tty: serial: atmel: Call dma_async_issue_pending() [5.10,106/563] mfd: atmel-flexcom: Remove #ifdef CONFIG_PM_SLEEP [5.10,108/563] media: rcar-csi2: Correct the selection of hsfreqrange [5.10,109/563] media: imx-pxp: Initialize the spinlock prior to using it [5.10,113/563] media: venus: pm_helpers: Control core power domain manually [5.10,115/563] media: venus: core: Fix a potential NULL pointer dereference in an error handling ... [5.10,119/563] arm64: dts: qcom: msm8916: fix MMC controller aliases [5.10,121/563] ACPI: EC: Rework flushing of EC work while suspended to idle [5.10,122/563] thermal/drivers/imx8mm: Enable ADC when enabling monitor [5.10,124/563] drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms() [5.10,127/563] arm64: dts: ti: k3-j7200: Correct the d-cache-sets info [5.10,129/563] serial: amba-pl011: do not request memory region twice [5.10,130/563] floppy: Fix hang in watchdog when disk is ejected [5.10,132/563] staging: rtl8192e: rtllib_module: fix error handle case in alloc_rtllib() [5.10,137/563] bpf: Disallow BPF_LOG_KERNEL log level for bpf(BPF_BTF_LOAD) [5.10,138/563] bpf: Remove config check to enable bpf support for branch records [5.10,141/563] media: dib8000: Fix a memleak in dib8000_init() [5.10,142/563] media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach() [5.10,147/563] rcu/exp: Mark current CPU as exp-QS in IPI loop second pass [5.10,148/563] mwifiex: Fix possible ABBA deadlock [5.10,149/563] xfrm: fix a small bug in xfrm_sa_len() [5.10,153/563] crypto: stm32 - Fix last sparse warning in stm32_cryp_check_ctr_counter [5.10,163/563] media: dw2102: Fix use after free [5.10,166/563] ath11k: Fix a NULL pointer dereference in ath11k_mac_op_hw_scan() [5.10,169/563] drm/msm/dpu: fix safe status debugfs file [5.10,171/563] drm/tegra: vic: Fix DMA API misuse [5.10,176/563] usb: ftdi-elan: fix memory leak on device disconnect [5.10,180/563] iwlwifi: mvm: fix 32-bit build in FTM [5.10,185/563] um: fix ndelay/udelay defines [5.10,190/563] backlight: qcom-wled: Pass number of elements to read to read_u32_array [5.10,191/563] backlight: qcom-wled: Fix off-by-one maximum with default num_strings [5.10,195/563] software node: fix wrong node passed to find nargs_prop [5.10,198/563] hwmon: (mr75203) fix wrong power-up delay value [5.10,201/563] pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_regi... [5.10,202/563] pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region() [5.10,205/563] bpf: Dont promote bogus looking registers after null check. [5.10,206/563] bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt(). [5.10,208/563] ppp: ensure minimum packet size in ppp_write() [5.10,209/563] rocker: fix a sleeping in atomic bug [5.10,210/563] staging: greybus: audio: Check null pointer [5.10,213/563] Bluetooth: hci_qca: Fix NULL vs IS_ERR_OR_NULL check in qca_serdev_probe [5.10,215/563] HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init [5.10,216/563] HID: hid-uclogic-params: Invalid parameter check in uclogic_params_get_str_desc [5.10,220/563] net/mlx5e: Fix page DMA map/unmap attributes [5.10,222/563] Revert "net/mlx5e: Block offload of outer header csum for UDP tunnels" [5.10,224/563] lib/mpi: Add the return value check of kcalloc() [5.10,226/563] spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe [5.10,227/563] ax25: uninitialized variable in ax25_setsockopt() [5.10,229/563] regmap: Call regmap_debugfs_exit() prior to _init() [5.10,235/563] pcmcia: fix setting of kthread task states [5.10,237/563] net: mcs7830: handle usb read errors properly [5.10,238/563] ext4: avoid trim error on fs with small groups [5.10,239/563] ALSA: jack: Add missing rwsem around snd_ctl_remove() calls [5.10,242/563] RDMA/bnxt_re: Scan the whole bitmap when checking if "disabling RCFW with pending ... [5.10,246/563] powerpc/prom_init: Fix improper check of prom_getprop() [5.10,248/563] dt-bindings: thermal: Fix definition of cooling-maps contribution property [5.10,249/563] powerpc/64s: Convert some cpu_setup() and cpu_restore() functions to C [5.10,250/563] powerpc/perf: MMCR0 control for PMU registers under PMCC=00 [5.10,252/563] powerpc/irq: Add helper to set regs->softe [5.10,257/563] ALSA: oss: fix compile error when OSS_DEBUG is enabled [5.10,258/563] ALSA: usb-audio: Drop superfluous 0 in Presonus Studio 1810cs ID [5.10,260/563] binder: fix handling of error during copy [5.10,262/563] uio: uio_dmem_genirq: Catch the Exception [5.10,264/563] scsi: ufs: Fix race conditions related to driver data [5.10,265/563] RDMA/qedr: Fix reporting max_{send/recv}_wr attrs [5.10,266/563] PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity() [5.10,269/563] RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry [5.10,271/563] of: unittest: fix warning on PowerPC frame size warning [5.10,272/563] of: unittest: 64 bit dma address test requires arch support [5.10,276/563] dmaengine: pxa/mmp: stop referencing config->slave_id [5.10,279/563] ASoC: Intel: catpt: Test dmaengine_submit() result before moving on [5.10,281/563] scsi: block: pm: Always set request queue runtime active in blk_post_runtime_resume() [5.10,285/563] misc: lattice-ecp3-config: Fix task hung when firmware load failed [5.10,289/563] mips: lantiq: add support for clk_set_parent() [5.10,291/563] powerpc/xive: Add missing null check after calling kmalloc [5.10,292/563] ASoC: fsl_mqs: fix MODULE_ALIAS [5.10,293/563] RDMA/cxgb4: Set queue pair state when being queried [5.10,294/563] ASoC: fsl_asrc: refine the check of available clock divider [5.10,296/563] of: base: Fix phandle argument length mismatch error message [5.10,299/563] fs: dlm: filter user dlm messages for kernel locks [5.10,300/563] libbpf: Validate that .BTF and .BTF.ext sections contain data [5.10,301/563] drm/lima: fix warning when CONFIG_DEBUG_SG=y & CONFIG_DMA_API_DEBUG=y [5.10,302/563] selftests/bpf: Fix bpf_object leak in skb_ctx selftest [5.10,304/563] drm/bridge: dw-hdmi: handle ELD when DRM_BRIDGE_ATTACH_NO_CONNECTOR [5.10,307/563] media: atomisp: set per-devices default mode [5.10,309/563] ARM: shmobile: rcar-gen2: Add missing of_node_put() [5.10,312/563] ath11k: Fix crash caused by uninitialized TX ring [5.10,314/563] drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L [5.10,319/563] drm/amd/display: check top_pipe_to_program pointer [5.10,321/563] soc: ti: pruss: fix referenced node in error message [5.10,325/563] gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use [5.10,326/563] HSI: core: Fix return freed object in hsi_new_client [5.10,327/563] crypto: jitter - consider 32 LSB for APT [5.10,332/563] media: venus: avoid calling core_clk_setrate() concurrently during concurrent vide... [5.10,333/563] ACPI / x86: Drop PWM2 device on Lenovo Yoga Book from always present table [5.10,335/563] ACPI / x86: Allow specifying acpi_device_override_status() quirks by path [5.10,336/563] ACPI / x86: Add not-present quirk for the PCI0.SDHB.BRC1 device on the GPD win [5.10,338/563] usb: uhci: add aspeed ast2600 uhci support [5.10,339/563] floppy: Add max size check for user space request [5.10,343/563] media: rcar-vin: Update format alignment constraints [5.10,345/563] media: m920x: dont use stack on USB reads [5.10,347/563] iwlwifi: mvm: synchronize with FW after multicast commands [5.10,348/563] iwlwifi: mvm: avoid clearing a just saved session protection id [5.10,349/563] ath11k: avoid deadlock by change ieee80211_queue_work for regd_update_work [5.10,350/563] ath10k: Fix tx hanging [5.10,353/563] gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock [5.10,354/563] selftests/ftrace: make kprobe profile testcase description unique [5.10,356/563] x86/mce: Allow instrumentation during task work queueing [5.10,357/563] x86/mce: Mark mce_panic() noinstr [5.10,358/563] x86/mce: Mark mce_end() noinstr [5.10,359/563] x86/mce: Mark mce_read_aux() noinstr [5.10,360/563] net: bonding: debug: avoid printing debug logs when bond is not notifying peers [5.10,362/563] HID: quirks: Allow inverting the absolute X/Y values [5.10,364/563] media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() [5.10,365/563] mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO [5.10,368/563] arm64: tegra: Adjust length of CCPLEX cluster MMIO region [5.10,370/563] cpufreq: Fix initialization of min and max frequency QoS requests [5.10,371/563] usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 [5.10,373/563] rtw88: 8822c: update rx settings to prevent potential hw deadlock [5.10,375/563] iwlwifi: fix leaks/bad data after failed firmware load [5.10,376/563] iwlwifi: remove module loading failure message [5.10,378/563] iwlwifi: pcie: make sure prph_info is set when treating wakeup IRQ [5.10,379/563] um: registers: Rename function names to avoid conflicts and build problems [5.10,383/563] drm/etnaviv: consider completed fence seqno in hang check [5.10,386/563] ACPICA: Utilities: Avoid deleting the same object twice in a row [5.10,387/563] ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() [5.10,390/563] drm/amdgpu: fixup bad vram size on gmc v8 [5.10,391/563] amdgpu/pm: Make sysfs pm attributes as read-only for VFs [5.10,392/563] ACPI: battery: Add the ThinkPad "Not Charging" quirk [5.10,396/563] mac80211: allow non-standard VHT MCS-10/11 [5.10,398/563] dm space map common: add bounds check to sm_ll_lookup_bitmap() [5.10,400/563] net: phy: marvell: configure RGMII delays for 88E1118 [5.10,402/563] regulator: qcom_smd: Align probe function with rpmh-regulator [5.10,404/563] serial: core: Keep mctrl register state and cached copy in sync [5.10,405/563] random: do not throw away excess input to crng_fast_load [5.10,413/563] powerpc/watchdog: Fix missed watchdog reset due to memory ordering race [5.10,414/563] i2c: i801: Dont silently correct invalid transfer size [5.10,417/563] clk: meson: gxbb: Fix the SDM_EN bit for MPLL0 on GXBB [5.10,423/563] dm: fix alloc_dax error handling in alloc_dev [5.10,424/563] scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup [5.10,427/563] powerpc/40x: Map 32Mbytes of memory at startup [5.10,428/563] selftests/powerpc/spectre_v2: Return skip code when miss_percent is high [5.10,430/563] powerpc/fadump: Fix inaccurate CPU state info in vmcore generated with panic [5.10,435/563] MIPS: Octeon: Fix build errors using clang [5.10,437/563] ASoC: mediatek: mt8173: fix device_node leak [5.10,440/563] rpmsg: core: Clean up resources on announce_create failure. [5.10,444/563] ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers [5.10,445/563] tpm: fix NPE on probe for missing device [5.10,448/563] fuse: Pass correct lend value to filemap_write_and_wait_range() [5.10,453/563] s390/mm: fix 2KB pgtable release race [5.10,456/563] drm/nouveau/kms/nv04: use vzalloc for nv04_display [5.10,459/563] powerpc/64s/radix: Fix huge vmap false positive [5.10,464/563] PCI: pci-bridge-emul: Properly mark reserved PCIe bits in PCI config space [5.10,469/563] btrfs: fix deadlock between quota enable and other quota operations [5.10,474/563] ext4: fix a possible ABBA deadlock due to busy PA [5.10,478/563] ext4: Fix BUG_ON in ext4_bread when write quota data [5.10,479/563] ext4: use ext4_ext_remove_space() for fast commit replay delete range [5.10,483/563] ext4: dont use the orphan list when migrating an inode [5.10,487/563] can: mcp251xfd: mcp251xfd_tef_obj_read(): fix typo in error message [5.10,488/563] media: rcar-csi2: Optimize the selection PHTW register [5.10,492/563] Documentation: ACPI: Fix data node reference documentation [5.10,494/563] Documentation: fix firewire.rst ABI file path error [5.10,495/563] Bluetooth: hci_sync: Fix not setting adv set duration [5.10,506/563] bpftool: Remove inclusion of utilities.mak from Makefiles [5.10,514/563] f2fs: compress: fix potential deadlock of compress file [5.10,524/563] net: axienet: limit minimum TX ring size [5.10,525/563] net: axienet: Fix TX ring slot available check [5.10,526/563] net: axienet: fix number of TX ring slots for available check [5.10,529/563] HID: vivaldi: fix handling devices not using numbered reports [5.10,531/563] vdpa/mlx5: Fix wrong configuration of virtio_version_1_0 [5.10,533/563] taskstats: Cleanup the use of task->exit_code [5.10,535/563] netns: add schedule point in ops_exit_list() [5.10,536/563] xfrm: Dont accidentally set RTO_ONLINK in decode_session4() [5.10,537/563] gre: Dont accidentally set RTO_ONLINK in gre_fill_metadata_dst() [5.10,538/563] libcxgb: Dont accidentally set RTO_ONLINK in cxgb_find_route() [5.10,541/563] dmaengine: at_xdmac: Start transfer for cyclic channels in issue_pending [5.10,542/563] dmaengine: at_xdmac: Print debug message after realeasing the lock [5.10,544/563] dmaengine: at_xdmac: Fix lld view setting [5.10,545/563] dmaengine: at_xdmac: Fix at_xdmac_lld struct definition [5.10,548/563] arm64: dts: qcom: msm8996: drop not documented adreno properties [5.10,549/563] net: bonding: fix bond_xmit_broadcast return value error bug [5.10,553/563] net: sfp: fix high power modules without diagnostic monitoring [5.10,555/563] dt-bindings: display: meson-dw-hdmi: add missing sound-name-prefix property [5.10,556/563] dt-bindings: display: meson-vpu: Add missing amlogic,canvas property [5.10,557/563] dt-bindings: watchdog: Require samsung,syscon-phandle for Exynos7 [5.10,559/563] lib82596: Fix IRQ check in sni_82596_probe [5.10,561/563] lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test [5.10,562/563] mtd: nand: bbt: Fix corner case in bad block table handling

[5.10,312/563] ath11k: Fix crash caused by uninitialized TX ring

Commit Message

Patch