ACK: [SRU][R][PATCH 0/1] Fix ath12k memory corruption and double free

Tue Oct 6 06:31:04 UTC 2026

Acked-by: Ivan Hu <ivan.hu at canonical.com>

On Mon, Oct 5, 2026 at 9:24 PM Yufeng Gao via kernel-team <
kernel-team at lists.ubuntu.com> wrote:

> BugLink: https://bugs.launchpad.net/bugs/2169101
>
> [Impact]
>
> On WCN7850 (FastConnect 7800, ath12k) adapters connected to an MLO
> access point with more than one link, a firmware restart makes
> ath12k_dp_rx_reo_cmd_list_cleanup() DMA-unmap and free the same REO
> queue buffer once per link. The kernel logs a burst of WARNINGs in
> iommu_dma_unmap_phys() and memory is corrupted. Tens of seconds later
> unrelated subsystems crash.
>
> On my system this happened twice on 7.0.0-34-generic:
>
>  1. Firmware restart, then 40 s later a kernel NULL pointer
>     dereference in zfs (zap_leaf_lookup) on the ZFS root, captured in
>     pstore.
>  2. Firmware restart, then about 11 minutes later a hard lockup with a
>     black screen and an unresponsive gnome-shell. The following warm
>     reboot hung before journald started; only a full power-off
>     recovered the machine.
>
> The firmware restart was triggered by an ordinary disconnect/reconnect
> (switching SSIDs with nmcli) while associated to a 3-link MLO AP
> (6 GHz/320 MHz + 5 GHz + 2.4 GHz). The log shows:
>
>   ath12k_wifi7_pci 0000:4e:00.0: Timeout in receiving peer delete response
>   ath12k_wifi7_pci 0000:4e:00.0: failed to submit WMI_VDEV_DOWN cmd
>   ath12k_wifi7_pci 0000:4e:00.0: failed to down vdev 0: -108
>
> followed by 33 of:
>
>   WARNING: drivers/iommu/dma-iommu.c:1243 at
> iommu_dma_unmap_phys+0xf2/0x100, CPU#13: kworker/u192:0/12
>   Workqueue: ath12k_wq ath12k_core_restart [ath12k]
>   RIP: 0010:iommu_dma_unmap_phys+0xf2/0x100
>   Call Trace:
>    dma_unmap_phys+0x24a/0x340
>    dma_unmap_page_attrs+0x17/0x40
>    ath12k_dp_rx_reo_cmd_list_cleanup+0x147/0x260 [ath12k]
>    ath12k_dp_cmn_device_deinit+0xaa/0x150 [ath12k]
>    ath12k_core_restart+0x73/0x1e0 [ath12k]
>
> and, in the first occurrence (pstore, 40 s after the restart):
>
>   BUG: kernel NULL pointer dereference, address: 0000000000000018
>   Oops: Oops: 0000 [#1] SMP NOPTI
>   CPU: 9 UID: 1000 PID: 101860 Comm: pool-96 Tainted: P W OE
> 7.0.0-34-generic #34-Ubuntu
>   RIP: 0010:zap_leaf_lookup+0x30/0x180 [zfs]
>
> Any WCN7850 user on an MLO-capable (Wi-Fi 7) router is exposed. MLO is
> the default on many current consumer routers.
>
> [Fix]
>
> Upstream commit, merged for v7.1 via wireless-2026-04-30:
>
>   4a1b534177395627579c1fb9e7f9100ee88955dd
>   "wifi: ath12k: prepare REO update element only for primary link"
>   Fixes: 3bf2e57e7d6c ("wifi: ath12k: Add Retry Mechanism for REO RX Queue
> Update Failures")
>   Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221011
>   Link:
> https://patch.msgid.link/20260210-ath12k-rxtid-double-free-v1-1-8b523fb2886d@oss.qualcomm.com
>
> It was not tagged Cc: stable, so it never reached 7.0.y and is missing
> from Ubuntu 7.0.0-34.34 (7.0.14 base). This was checked against the
> linux-source-7.0.0 7.0.0-34.34 tree; the changelog does not mention it
> either.
>
> It is a 3-line change that applies cleanly to Ubuntu-7.0.0-34.34 (only
> the context differs: kzalloc -> kzalloc_obj):
>
>   --- a/drivers/net/wireless/ath/ath12k/dp_rx.c
>   +++ b/drivers/net/wireless/ath/ath12k/dp_rx.c
>   @@ -565,6 +565,9 @@ static int ath12k_dp_prepare_reo_update_elem(struct
> ath12k_dp *dp,
>     lockdep_assert_held(&dp->dp_lock);
>
>   + if (!peer->primary_link)
>   + return 0;
>   +
>     elem = kzalloc_obj(*elem, GFP_ATOMIC);
>
> Please cherry-pick 4a1b53417739 into the Resolute kernels (generic,
> generic-hwe, and the oem-26.04* kernels, which are also 7.0-based).
>
> [Test Plan]
>
>  1. On a machine with a WCN7850 (17cb:1107), connect to a Wi-Fi 7 AP
>     with MLO enabled on 2 or more links (iw dev <if> link shows Link
> 0/1/2).
>  2. Repeatedly switch away from and back to the MLO SSID (nmcli
>     connection up <other>; nmcli connection up <mlo>) until a firmware
>     restart occurs ("Timeout in receiving peer delete response" /
>     ath12k_core_restart).
>  3. Unpatched: iommu_dma_unmap_phys WARNINGs from
>     ath12k_dp_rx_reo_cmd_list_cleanup, followed by memory corruption
>     and crashes in unrelated code.
>     Patched: the restart completes ("pdev 0 successfully recovered")
>     without WARNINGs and the system stays stable.
>
> I built ath12k from linux-source-7.0.0 (7.0.0-34.34) with only this
> patch applied, signed it with my MOK and loaded it on 7.0.0-34-generic.
> It loads and works normally (157 Mbit/s on 6 GHz/320 MHz) with no
> WARNINGs. Note: because of that, any logs attached after this point
> show taint O from the out-of-tree test module. The two crashes above
> happened with the stock in-tree ath12k (taint only from nvidia/zfs).
>
> [Where problems could occur]
>
> The change only affects the REO update-element bookkeeping for
> non-primary link peers on chips without dp_primary_link_only (such as
> WCN7850). Chips with dp_primary_link_only (QCN9274) already behaved
> this way. A regression would show up as REO queue buffers for
> non-primary links not being tracked for flush/retry, which in the
> worst case could leak the buffer or stall RX on a secondary MLO link
> after an REO update failure. Non-MLO (single-link) operation is
> unaffected because every peer is then the primary link.
>
> Baochen Qiang (1):
>   wifi: ath12k: prepare REO update element only for primary link
>
>  drivers/net/wireless/ath/ath12k/dp_rx.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> --
> 2.43.0
>
>
> --
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20261006/6f030fca/attachment.html>