Re: [PATCH v2] ath12k: fix NULL pointer dereference in rhash table destroy

[Vasanthakumar Thiagarajan]

On 7/5/2026 10:53 PM, Vasanthakumar Thiagarajan wrote:
> On 6/15/2026 4:51 PM, Jose Ignacio Tornos Martinez wrote:
> > When unbinding the ath12k driver, kernel NULL pointer dereferences
> > occur in irq_work_sync() called from rhashtable_destroy().
> >
> > Two hash tables are affected:
> > 1. ath12k_link_sta hash table in ath12k_base
> > 2. ath12k_dp_link_peer hash table in ath12k_dp
> >
> > The issue happens because the destroy functions are called unconditionally
> > in cleanup paths, but the hash tables are only initialized late in their
> > respective init functions. If the device was never fully started or if the
> > init functions failed before initializing the hash tables, the pointers
> > will be NULL. The issues are always reproducible from a VM because the MSI
> > addressing initialization is failing.
> >
> > Call trace for ath12k_link_sta_rhash_tbl_destroy:
> >   RIP: irq_work_sync+0x1e/0x70
> >   rhashtable_destroy+0x12/0x60
> >   ath12k_link_sta_rhash_tbl_destroy+0x19/0x40 [ath12k]
> >   ath12k_core_stop+0xe/0x80 [ath12k]
> >   ath12k_core_hw_group_cleanup+0x6b/0xb0 [ath12k]
> >   ath12k_pci_remove+0x60/0x110 [ath12k]
> >
> > Call trace for ath12k_dp_link_peer_rhash_tbl_destroy:
> >   RIP: irq_work_sync+0x1e/0x70
> >   rhashtable_destroy+0x12/0x60
> >   ath12k_dp_link_peer_rhash_tbl_destroy+0x29/0x50 [ath12k]
> >   ath12k_dp_cmn_device_deinit+0x21/0x140 [ath12k]
> >   ath12k_core_hw_group_cleanup+0x6b/0xb0 [ath12k]
> >   ath12k_pci_remove+0x60/0x110 [ath12k]
> >
> > Fix this by adding NULL checks before calling rhashtable_destroy() in
> > both destroy functions.
> >
> > The NULL check approach was chosen because the rhashtable pointer
> > serves as the initialization state indicator. The init can fail at
> > various points, leaving some components uninitialized. Checking the
> > pointer directly is simpler than adding separate state flags that
> > would need synchronization.
> >
> > Fixes: 57ccca410237 ("wifi: ath12k: Add hash table for ath12k_link_sta in ath12k_base")
> > Fixes: a88cf5f71adf ("wifi: ath12k: Add hash table for ath12k_dp_link_peer")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@xxxxxxxxxx>
>
> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@xxxxxxxxxxxxxxxx>

Missed to mention that pls add wifi prefix to the patch title.