linux-kernel - [PATCH ath-next] wifi: ath12k: fix memory leak in WMI firmware stats

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250507-fw-stats-mem-leak-v1-1-8d4d1d8ec0e8@quicinc.com>
Date: Wed, 7 May 2025 22:41:19 +0530
From: Raj Kumar Bhagat <quic_rajkbhag@...cinc.com>
To: Jeff Johnson <jjohnson@...nel.org>,
        Aditya Kumar Singh
	<aditya.kumar.singh@....qualcomm.com>,
        Rameshkumar Sundaram
	<rameshkumar.sundaram@....qualcomm.com>,
        Mahendran P <quic_mahep@...cinc.com>
CC: Jeff Johnson <jeff.johnson@....qualcomm.com>,
        <linux-wireless@...r.kernel.org>, <ath12k@...ts.infradead.org>,
        <linux-kernel@...r.kernel.org>,
        P Praneesh <praneesh.p@....qualcomm.com>,
        "Raj Kumar Bhagat" <quic_rajkbhag@...cinc.com>
Subject: [PATCH ath-next] wifi: ath12k: fix memory leak in WMI firmware
 stats

From: P Praneesh <praneesh.p@....qualcomm.com>

Memory allocated for firmware pdev, vdev and beacon statistics
are not released during rmmod. Below kmemleak trace is seen for this
memory leak:

unreferenced object 0xffff8e76aebdfa00 (size 256):
  comm "softirq", pid 0, jiffies 4299272453
  hex dump (first 32 bytes):
    28 19 71 c3 76 8e ff ff 28 19 71 c3 76 8e ff ff  (.q.v...(.q.v...
    9f ff ff ff f4 d4 03 00 aa 88 09 00 bd 40 23 00  .............@#.
  backtrace (crc dfe1b440):
    __kmalloc_cache_noprof+0x2b0/0x370
    ath12k_wmi_tlv_fw_stats_data_parse.isra.0+0x44e/0x730 [ath12k]
    ath12k_wmi_tlv_iter+0x5e/0x140 [ath12k]
    ath12k_update_stats_event+0x85/0x300 [ath12k]
    ath12k_wmi_op_rx+0x624/0xd70 [ath12k]
    ath12k_htc_rx_completion_handler+0x1f4/0x330 [ath12k]
    ath12k_ce_recv_process_cb+0x218/0x300 [ath12k]
    ath12k_pci_ce_workqueue+0x1b/0x30 [ath12k]
    process_one_work+0x219/0x680
    bh_worker+0x198/0x1f0
    tasklet_action+0x13/0x30
    handle_softirqs+0xca/0x460
    __irq_exit_rcu+0xbe/0x110
    irq_exit_rcu+0x9/0x30
    common_interrupt+0xa7/0xc0
    asm_common_interrupt+0x26/0x40

Fix this by calling ath12k_fw_stats_reset() before hardware unregister.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1

Fixes: b8a0d83fe4c7 ("wifi: ath12k: move firmware stats out of debugfs")
Signed-off-by: P Praneesh <praneesh.p@....qualcomm.com>
Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@...cinc.com>
---
 drivers/net/wireless/ath/ath12k/mac.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index 4dae941c9615cf19e6cc2ed1bd72a6bf1cb812ca..5a14e4241e25d40173a7315f4407826ec412fe59 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -11374,6 +11374,7 @@ static void ath12k_mac_hw_unregister(struct ath12k_hw *ah)
 	for_each_ar(ah, ar, i) {
 		cancel_work_sync(&ar->regd_update_work);
 		ath12k_debugfs_unregister(ar);
+		ath12k_fw_stats_reset(ar);
 	}
 
 	ieee80211_unregister_hw(hw);

---
base-commit: 21346cd925c2567d5f56cdb1421c94815ac10221
change-id: 20250507-fw-stats-mem-leak-c87b6384055c