[PATCH v2] ath12k: fix NULL pointer dereference in rhash table destroy
Jose Ignacio Tornos Martinez
jtornosm at redhat.com
Wed Jul 1 23:07:44 PDT 2026
Gentle ping on this patch.
This fixes a NULL pointer dereference during driver unbind that
crashes the kernel when initialization failed partially. The crash
is 100% reproducible when unbinding after an initialization failure.
This is particularly critical for VM environments with VFIO passthrough.
Regarding the concern from v1 about preferring symmetric init/deinit:
I understand the preference for unwinding init failures at each stage.
However, implementing full symmetric cleanup would require extensive
refactoring of multiple error paths across ath12k_core_start(),
ath12k_dp_alloc(), and related initialization functions.
The NULL check approach provides a safe, minimal fix that:
1. Prevents the crash without changing complex init logic
2. Follows the same pattern used elsewhere in the kernel for
conditional cleanup (e.g., other rhashtable users)
3. Has been tested and validated in the failing scenario
I've addressed the guard(mutex) feedback from v1 in this v2.
If Qualcomm engineering prefers a different approach, I'm happy to
revise, but no alternative has been suggested since the v1 discussion.
Please let me know if there are any other concerns.
Thanks
Best regards
Jose Ignacio
More information about the ath12k
mailing list