linux-kernel - Re: [PATCH v2 ath-next 2/2] wifi: ath11k: fix HTC rx insufficient length

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z9METTzUJe9yqVEI@hovoldconsulting.com>
Date: Thu, 13 Mar 2025 17:14:05 +0100
From: Johan Hovold <johan@...nel.org>
To: Miaoqing Pan <quic_miaoqing@...cinc.com>
Cc: Jeff Johnson <jeff.johnson@....qualcomm.com>,
	ath11k@...ts.infradead.org, linux-wireless@...r.kernel.org,
	linux-kernel@...r.kernel.org, johan+linaro@...nel.org
Subject: Re: [PATCH v2 ath-next 2/2] wifi: ath11k: fix HTC rx insufficient
 length

On Thu, Mar 13, 2025 at 09:31:56PM +0800, Miaoqing Pan wrote:
> On 3/13/2025 12:43 AM, Johan Hovold wrote:
> > On Wed, Mar 12, 2025 at 09:11:45AM +0800, Miaoqing Pan wrote:
> >> On 3/11/2025 11:20 PM, Jeff Johnson wrote:

> >>> That didn't answer Johan's first question:
> >>> Are there ever any valid reasons for seeing a zero-length descriptor?
> >>
> >> The events currently observed are all firmware logs. The discarded
> >> packets will not affect normal operation. I will adjust the logging to
> >> debug level.

Have you looked at the device side of things as well? Could it be that
the firmware is doing something wrong when forwarding the logs?

How sure are you that you only see this with firmware logs?

> > I've taken a closer look at the driver and it seems like we're missing a
> > read barrier to make sure that the updated descriptor is not read until
> > after the head pointer.
> > 
> > Miaoqing, could you try the below patch with your reproducer and see if
> > it is enough to fix the corruption?
  
> > +	/* Make sure descriptor is read after the head pointer. */
> > +	dma_rmb();
> > +
> >   	*nbytes = ath11k_hal_ce_dst_status_get_length(desc);
> >   	if (*nbytes == 0) {
> > +		WARN_ON_ONCE(1);	// FIXME: remove
> >   		ret = -EIO;
> >   		goto err;
> >   	}
> 
> This issue can still be reproduced.
> 
> [ 3283.687469] WARNING: CPU: 0 PID: 0 at 
> /drivers/net/wireless/ath/ath11k/ce.c:405 
> ath11k_ce_per_engine_service+0x228/0x3e4 [ath11k]

Thanks for verifying.

Which platform are you testing on and which kernel are you using?

I'm still waiting to hear back from some people testing my patch on the
X13s (sc8280xp).

Johan