[SRU][R][PATCH 0/1] Fix ath12k memory corruption and double free

Mon Oct 5 13:23:04 UTC 2026

BugLink: https://bugs.launchpad.net/bugs/2169101

[Impact]

On WCN7850 (FastConnect 7800, ath12k) adapters connected to an MLO
access point with more than one link, a firmware restart makes
ath12k_dp_rx_reo_cmd_list_cleanup() DMA-unmap and free the same REO
queue buffer once per link. The kernel logs a burst of WARNINGs in
iommu_dma_unmap_phys() and memory is corrupted. Tens of seconds later
unrelated subsystems crash.

On my system this happened twice on 7.0.0-34-generic:

 1. Firmware restart, then 40 s later a kernel NULL pointer
    dereference in zfs (zap_leaf_lookup) on the ZFS root, captured in
    pstore.
 2. Firmware restart, then about 11 minutes later a hard lockup with a
    black screen and an unresponsive gnome-shell. The following warm
    reboot hung before journald started; only a full power-off
    recovered the machine.

The firmware restart was triggered by an ordinary disconnect/reconnect
(switching SSIDs with nmcli) while associated to a 3-link MLO AP
(6 GHz/320 MHz + 5 GHz + 2.4 GHz). The log shows:

  ath12k_wifi7_pci 0000:4e:00.0: Timeout in receiving peer delete response
  ath12k_wifi7_pci 0000:4e:00.0: failed to submit WMI_VDEV_DOWN cmd
  ath12k_wifi7_pci 0000:4e:00.0: failed to down vdev 0: -108

followed by 33 of:

  WARNING: drivers/iommu/dma-iommu.c:1243 at iommu_dma_unmap_phys+0xf2/0x100, CPU#13: kworker/u192:0/12
  Workqueue: ath12k_wq ath12k_core_restart [ath12k]
  RIP: 0010:iommu_dma_unmap_phys+0xf2/0x100
  Call Trace:
   dma_unmap_phys+0x24a/0x340
   dma_unmap_page_attrs+0x17/0x40
   ath12k_dp_rx_reo_cmd_list_cleanup+0x147/0x260 [ath12k]
   ath12k_dp_cmn_device_deinit+0xaa/0x150 [ath12k]
   ath12k_core_restart+0x73/0x1e0 [ath12k]

and, in the first occurrence (pstore, 40 s after the restart):

  BUG: kernel NULL pointer dereference, address: 0000000000000018
  Oops: Oops: 0000 [#1] SMP NOPTI
  CPU: 9 UID: 1000 PID: 101860 Comm: pool-96 Tainted: P W OE 7.0.0-34-generic #34-Ubuntu
  RIP: 0010:zap_leaf_lookup+0x30/0x180 [zfs]

Any WCN7850 user on an MLO-capable (Wi-Fi 7) router is exposed. MLO is
the default on many current consumer routers.

[Fix]

Upstream commit, merged for v7.1 via wireless-2026-04-30:

  4a1b534177395627579c1fb9e7f9100ee88955dd
  "wifi: ath12k: prepare REO update element only for primary link"
  Fixes: 3bf2e57e7d6c ("wifi: ath12k: Add Retry Mechanism for REO RX Queue Update Failures")
  Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221011
  Link: https://patch.msgid.link/20260210-ath12k-rxtid-double-free-v1-1-8b523fb2886d@oss.qualcomm.com

It was not tagged Cc: stable, so it never reached 7.0.y and is missing
from Ubuntu 7.0.0-34.34 (7.0.14 base). This was checked against the
linux-source-7.0.0 7.0.0-34.34 tree; the changelog does not mention it
either.

It is a 3-line change that applies cleanly to Ubuntu-7.0.0-34.34 (only
the context differs: kzalloc -> kzalloc_obj):

  --- a/drivers/net/wireless/ath/ath12k/dp_rx.c
  +++ b/drivers/net/wireless/ath/ath12k/dp_rx.c
  @@ -565,6 +565,9 @@ static int ath12k_dp_prepare_reo_update_elem(struct ath12k_dp *dp,
    lockdep_assert_held(&dp->dp_lock);

  + if (!peer->primary_link)
  + return 0;
  +
    elem = kzalloc_obj(*elem, GFP_ATOMIC);

Please cherry-pick 4a1b53417739 into the Resolute kernels (generic,
generic-hwe, and the oem-26.04* kernels, which are also 7.0-based).

[Test Plan]

 1. On a machine with a WCN7850 (17cb:1107), connect to a Wi-Fi 7 AP
    with MLO enabled on 2 or more links (iw dev <if> link shows Link 0/1/2).
 2. Repeatedly switch away from and back to the MLO SSID (nmcli
    connection up <other>; nmcli connection up <mlo>) until a firmware
    restart occurs ("Timeout in receiving peer delete response" /
    ath12k_core_restart).
 3. Unpatched: iommu_dma_unmap_phys WARNINGs from
    ath12k_dp_rx_reo_cmd_list_cleanup, followed by memory corruption
    and crashes in unrelated code.
    Patched: the restart completes ("pdev 0 successfully recovered")
    without WARNINGs and the system stays stable.

I built ath12k from linux-source-7.0.0 (7.0.0-34.34) with only this
patch applied, signed it with my MOK and loaded it on 7.0.0-34-generic.
It loads and works normally (157 Mbit/s on 6 GHz/320 MHz) with no
WARNINGs. Note: because of that, any logs attached after this point
show taint O from the out-of-tree test module. The two crashes above
happened with the stock in-tree ath12k (taint only from nvidia/zfs).

[Where problems could occur]

The change only affects the REO update-element bookkeeping for
non-primary link peers on chips without dp_primary_link_only (such as
WCN7850). Chips with dp_primary_link_only (QCN9274) already behaved
this way. A regression would show up as REO queue buffers for
non-primary links not being tracked for flush/retry, which in the
worst case could leak the buffer or stall RX on a secondary MLO link
after an REO update failure. Non-MLO (single-link) operation is
unaffected because every peer is then the primary link.

Baochen Qiang (1):
  wifi: ath12k: prepare REO update element only for primary link

 drivers/net/wireless/ath/ath12k/dp_rx.c | 3 +++
 1 file changed, 3 insertions(+)

-- 
2.43.0