linux-kernel - [PATCH ath-next 0/4] wifi: ath12k: harden stats/rate handling for WCN785x stability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260209030243.1530075-1-m.limarencko@yandex.ru>
Date: Mon,  9 Feb 2026 06:02:39 +0300
From: m.limarencko@...dex.ru
To: jjohnson@...nel.org
Cc: linux-wireless@...r.kernel.org,
	ath12k@...ts.infradead.org,
	linux-kernel@...r.kernel.org,
	Mikhail Limarenko <m.limarencko@...dex.ru>
Subject: [PATCH ath-next 0/4] wifi: ath12k: harden stats/rate handling for WCN785x stability

From: Mikhail Limarenko <m.limarencko@...dex.ru>

Hi Jeff, all,

On QCNFA765/WCN785x (PCI, kernel 6.18.5) we observed three recurring
issues:

- chan info events with frequency not present in local survey range,
  producing invalid idx warnings;
- frequent VDEV_STAT polling can block for 3 seconds on fw_stats_done
  timeouts and cause visible hitches;
- occasional invalid MCS metadata (for example HE MCS=12) propagates
  into mac80211 status handling and correlates with ieee80211_rx_list
  warnings.

This series addresses those cases by:
1. returning -EINVAL from freq_to_idx() when no channel matches, and
   rejecting negative indexes in callers;
2. reducing the wait on VDEV_STAT fw_stats completion and skipping
   unnecessary waits for stats types that do not require it;
3. sanitizing invalid MCS metadata in both dp_rx and dp_mon paths by
   falling back to legacy metadata with ratelimited diagnostics.

Tested on:
- hardware: QCNFA765 (WCN785x)
- kernel: 6.18.5+deb13-amd64
- AP mode: 5 GHz (802.11ac)

Observed after applying this series:
- station dump polling no longer shows multi-second stalls in test runs;
- no fresh ieee80211_rx_list WARN was observed in the same windows.

If patch 1/4 is already present in ath-next or stable trees, please drop
it and keep the remaining fixes.

Thanks,
Mikhail Limarenko

Mikhail Limarenko (4):
  wifi: ath12k: validate survey index when frequency is not found
  wifi: ath12k: avoid long fw_stats waits on vdev stats hot path
  wifi: ath12k: sanitize invalid MCS metadata in rx path
  wifi: ath12k: sanitize invalid MCS metadata in monitor rx path

 drivers/net/wireless/ath/ath12k/dp_mon.c | 38 ++++++++++++++---------
 drivers/net/wireless/ath/ath12k/dp_rx.c  | 39 ++++++++++++++----------
 drivers/net/wireless/ath/ath12k/mac.c    | 22 +++++++++++--
 drivers/net/wireless/ath/ath12k/wmi.c    | 13 ++++----
 4 files changed, 73 insertions(+), 39 deletions(-)

-- 
2.47.3