[PATCH ath-next] wifi: ath12k: Avoid accessing uninitialized arvif->ar during beacon miss

[Vasanthakumar Thiagarajan]

On 6/19/2025 12:26 AM, Rameshkumar Sundaram wrote:
> During beacon miss handling, ath12k driver iterates over active virtual
> interfaces (vifs) and attempts to access the radio object (ar) via
> arvif->deflink->ar.
> 
> However, after commit aa80f12f3bed ("wifi: ath12k: defer vdev creation for
> MLO"), arvif is linked to a radio only after vdev creation, typically when
> a channel is assigned or a scan is requested.
> For P2P capable devices, a default P2P interface is created by
> wpa_supplicant along with regular station interfaces, these serve as dummy
> interfaces for P2P-capable stations, lack an associated netdev and initiate
> frequent scans to discover neighbor p2p devices. When a scan is initiated
> on such P2P vifs, driver selects destination radio (ar) based on scan
> frequency, creates a scan vdev, and attaches arvif to the radio. Once the
> scan completes or is aborted, the scan vdev is deleted, detaching arvif
> from the radio and leaving arvif->ar uninitialized.
> 
> While handling beacon miss for station interfaces, P2P interface is also
> encountered in the vif iteration and ath12k_mac_handle_beacon_miss_iter()
> tries to dereference the uninitialized arvif->deflink->ar.
> 
> Fix this by verifying that vdev is created for the arvif before accessing
> its ar during beacon miss handling and similar vif iterator callbacks.
> 
> ==========================================================================
>   wlp6s0: detected beacon loss from AP (missed 7 beacons) - probing
>   KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
> 
>   CPU: 5 UID: 0 PID: 0 Comm: swapper/5 Not tainted 6.16.0-rc1-wt-ath+ #2 PREEMPT(full)
>   RIP: 0010:ath12k_mac_handle_beacon_miss_iter+0xb5/0x1a0 [ath12k]
>   Call Trace:
>    __iterate_interfaces+0x11a/0x410 [mac80211]
>    ieee80211_iterate_active_interfaces_atomic+0x61/0x140 [mac80211]
>    ath12k_mac_handle_beacon_miss+0xa1/0xf0 [ath12k]
>    ath12k_roam_event+0x393/0x560 [ath12k]
>    ath12k_wmi_op_rx+0x1486/0x28c0 [ath12k]
>    ath12k_htc_process_trailer.isra.0+0x2fb/0x620 [ath12k]
>    ath12k_htc_rx_completion_handler+0x448/0x830 [ath12k]
>    ath12k_ce_recv_process_cb+0x549/0x9e0 [ath12k]
>    ath12k_ce_per_engine_service+0xbe/0xf0 [ath12k]
>    ath12k_pci_ce_workqueue+0x69/0x120 [ath12k]
>    process_one_work+0xe3a/0x1430
> 
> Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
> Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
> 
> Fixes: aa80f12f3bed ("wifi: ath12k: defer vdev creation for MLO")
> Signed-off-by: Rameshkumar Sundaram <rameshkumar.sundaram at oss.qualcomm.com>

Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan at oss.qualcomm.com>