Public bug reported: Here I generated a report using an LLM (originally Claude produced and .md file, I just copy paste its content in plain text).
# Launchpad bug report — btmtk NULL pointer dereference on MT7922 **Package:** linux (noble) **File with:** `ubuntu-bug linux`, run while booted on 6.8.0-139-generic --- ## Title ``` btmtk: NULL pointer dereference in __pm_runtime_resume via btmtk_usb_hci_wmt_sync, MT7922 Bluetooth controller fails to register (6.8.0-139-generic) ``` --- ## Description Bluetooth is completely non-functional on 6.8.0-139-generic. The MT7922 Bluetooth controller fails to initialise because the kernel takes a NULL pointer dereference inside `btmtk_setup_firmware_79xx()` during `hci_power_on`. The kworker handling the setup dies, `hci0` is never registered, and no controller is available to userspace. ### System - Ubuntu 24.04 LTS (noble), amd64 - Kernel: 6.8.0-139-generic (6.8.0-139.139) - Machine: ASUSTeK COMPUTER INC. ROG Strix G713PV_G713PV/G713PV - BIOS: G713PV.334, 09/03/2024 - Wireless/BT combo: MediaTek MT7922 - Wi-Fi: `mt7921e`, ASIC revision 79220010 (working normally) - Bluetooth: `btusb` + `btmtk` (broken) - linux-firmware: 20240318.git3b128b60.0ubuntu3.1 - linux-firmware-mediatek: 20240318.git3b128b60-0ubuntu3.1 ### Steps to reproduce 1. Boot 6.8.0-139-generic on the affected hardware. 2. Attempt to enable Bluetooth, or run `bluetoothctl list`. ### Expected result `hci0` registers and a controller is listed. ### Actual result - The Bluetooth toggle in GNOME Settings is unavailable. - `bluetoothctl list` returns nothing; no default controller. - `bluetooth.service` starts and runs normally (`bluetoothd` active). - `rfkill list` shows `hci0` present, neither soft nor hard blocked. - A kernel oops is logged approximately 3.9 s into boot. ### Kernel log ``` [ 3.941556] usbcore: registered new interface driver btusb [ 3.946176] Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20250523103438 [ 3.946199] BUG: kernel NULL pointer dereference, address: 0000000000000219 [ 3.946205] #PF: supervisor read access in kernel mode [ 3.946208] #PF: error_code(0x0000) - not-present page [ 3.946210] PGD 0 P4D 0 [ 3.946215] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 3.946218] CPU: 13 PID: 286 Comm: kworker/u67:0 Not tainted 6.8.0-139-generic #139-Ubuntu [ 3.946221] Hardware name: ASUSTeK COMPUTER INC. ROG Strix G713PV_G713PV/G713PV, BIOS G713PV.334 09/03/2024 [ 3.946223] Workqueue: hci0 hci_power_on [bluetooth] [ 3.946270] RIP: 0010:__pm_runtime_resume+0x1b/0x80 [ 3.946276] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 56 41 55 41 54 41 89 f4 83 e6 01 53 48 89 fb 75 09 <f6> 87 c9 01 00 00 04 74 4a 41 f6 c4 04 74 07 f0 ff 83 c0 01 00 00 [ 3.946277] RSP: 0018:ffffd10900c17b30 EFLAGS: 00010246 [ 3.946279] RAX: ffff8c13c11154d0 RBX: 0000000000000050 RCX: 0000000000000000 [ 3.946281] RDX: 0000000000000035 RSI: 0000000000000000 RDI: 0000000000000050 [ 3.946282] RBP: ffffd10900c17b50 R08: 0000000000000000 R09: 0000000000000000 [ 3.946284] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000004 [ 3.946285] R13: 0000000000000035 R14: 000000000000003a R15: ffffd10900c17be8 [ 3.946286] FS: 0000000000000000(0000) GS:ffff8c1add480000(0000) knlGS:0000000000000000 [ 3.946288] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3.946289] CR2: 0000000000000219 CR3: 000000011374a000 CR4: 0000000000f50ef0 [ 3.946290] PKRU: 55555554 [ 3.946292] Call Trace: [ 3.946294] <TASK> [ 3.946298] usb_autopm_get_interface+0x1d/0x60 [ 3.946303] btmtk_usb_hci_wmt_sync+0xa9/0x2e0 [btmtk] [ 3.946307] ? __pfx_btmtk_usb_hci_wmt_sync+0x10/0x10 [btmtk] [ 3.946310] btmtk_setup_firmware_79xx+0x1c7/0x360 [btmtk] [ 3.946315] btusb_mtk_setup+0x453/0x610 [btusb] [ 3.946320] hci_dev_setup_sync+0x6c/0x430 [bluetooth] [ 3.946339] ? __pm_runtime_idle+0x4c/0xd0 [ 3.946342] hci_dev_init_sync+0x3e/0x1c0 [bluetooth] [ 3.946357] hci_dev_open_sync+0xb1/0x350 [bluetooth] [ 3.946372] ? srso_alias_return_thunk+0x5/0xfbef5 [ 3.946377] hci_dev_do_open+0x28/0x70 [bluetooth] [ 3.946392] hci_power_on+0x50/0x210 [bluetooth] [ 3.946408] ? srso_alias_return_thunk+0x5/0xfbef5 [ 3.946411] ? __try_to_del_timer_sync+0x5f/0xa0 [ 3.946414] process_one_work+0x181/0x3a0 [ 3.946418] worker_thread+0x18b/0x330 [ 3.946420] ? __pfx_worker_thread+0x10/0x10 [ 3.946422] kthread+0xef/0x120 [ 3.946425] ? __pfx_kthread+0x10/0x10 [ 3.946427] ret_from_fork+0x44/0x70 [ 3.946431] ? __pfx_kthread+0x10/0x10 [ 3.946432] ret_from_fork_asm+0x1b/0x30 [ 3.946437] </TASK> [ 3.946517] CR2: 0000000000000219 [ 3.946520] ---[ end trace 0000000000000000 ]--- [ 4.082342] note: kworker/u67:0[286] exited with irqs disabled ``` ### Analysis The faulting instruction decodes from the `Code:` bytes (`f6 87 c9 01 00 00 04`) as `testb $0x4, 0x1c9(%rdi)`, with `RDI = 0x50` and `CR2 = 0x219 = 0x50 + 0x1c9`. `__pm_runtime_resume()` was therefore called with a `struct device *` of `0x50`. The immediate caller is `usb_autopm_get_interface()`, which passes `&intf->dev`, and `0x50` is consistent with `offsetof(struct usb_interface, dev)`. This indicates that `btmtk_usb_hci_wmt_sync()` reached `usb_autopm_get_interface()` with a NULL `struct usb_interface *`. Note that `Bluetooth: hci0: HW/SW Version: 0x008a008a` is printed immediately before the oops, so the firmware blob was located, read and its header parsed successfully. The fault occurs afterwards, on the WMT command path, not during firmware retrieval. The kernel is reported as `Not tainted` at the time of the fault. The out-of-tree NVIDIA module on this system loads later in boot (≈4.33 s), after the oops. ### Ruled out - **Firmware availability.** `BT_RAM_CODE_MT7922_1_1_hdr.bin.zst` is present in `/lib/firmware/mediatek/` and is owned by the installed `linux-firmware-mediatek` package. The driver parsed its header successfully, as shown above. - **Firmware version.** The failure persists across the linux-firmware 0ubuntu2.29 → 0ubuntu3.1 upgrade, including the reorganisation into per-vendor subpackages. - **Stale controller state.** Reproduced on a cold boot after a full power cycle (AC disconnected, power button held to drain residual charge), not only after warm reboots. - **rfkill / userspace.** The device is unblocked and `bluetoothd` runs normally. The controller never reaches userspace at all. ### Possibly related - Reported as a 6.8.0-139 regression by a Linux Mint 22.3 user (Ubuntu 24.04 base) with a MediaTek btmtk/btusb adapter on an ASUS ExpertBook B5602CBA; total Bluetooth loss, `bluetoothctl power on` returning "No default controller available", WMT errors in dmesg, resolved by booting 6.8.0-138: https://forum-francophone-linuxmint.fr/viewtopic.php?p=266977 - LP #2092473 — a previous NULL pointer dereference in the btmtk setup flow, fixed by cherry-picking `61c5a3def90a` ("Bluetooth: btmtk: adjust the position to init iso data anchor"). Same class of bug in the same driver, though not necessarily the same root cause. ### Notes - A grep of `apt changelog linux-image-6.8.0-139-generic` (5718 lines retrieved) returned no matches for `bluetooth`, `btmtk`, `btusb` or `mt79`. If accurate, this would suggest the trigger lies outside the Bluetooth drivers themselves — possibly in USB core or runtime PM — rather than in `btmtk.c`. I have not independently verified that the changelog fetch was complete, so this observation should be treated as provisional. - 6.8.0-138-generic is still installed on this system but has not yet been booted to confirm the regression boundary directly. ProblemType: Bug DistroRelease: Ubuntu 24.04 Package: linux-image-6.8.0-139-generic 6.8.0-139.139 ProcVersionSignature: Ubuntu 6.8.0-139.139-generic 6.8.12 Uname: Linux 6.8.0-139-generic x86_64 NonfreeKernelModules: nvidia_modeset nvidia ApportVersion: 2.28.3-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC1: enzo 2822 F.... wireplumber /dev/snd/controlC0: enzo 2822 F.... wireplumber /dev/snd/seq: enzo 2817 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Sat Sep 5 22:21:22 2026 InstallationDate: Installed on 2023-08-04 (1128 days ago) InstallationMedia: Ubuntu 22.04.2 LTS "Jammy Jellyfish" - Release amd64 (20230223) MachineType: ASUSTeK COMPUTER INC. ROG Strix G713PV_G713PV ProcFB: 0 nvidia-drmdrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.8.0-139-generic root=UUID=b7bb718d-fc6b-4961-b31c-39f8dbc13346 ro quiet splash mem_sleep_default=deep vt.handoff=7 RelatedPackageVersions: linux-restricted-modules-6.8.0-139-generic N/A linux-backports-modules-6.8.0-139-generic N/A linux-firmware 20240318.git3b128b60.0ubuntu3.1 SourcePackage: linux UpgradeStatus: Upgraded to noble on 2025-07-06 (426 days ago) dmi.bios.date: 09/03/2024 dmi.bios.release: 5.29 dmi.bios.vendor: American Megatrends International, LLC. dmi.bios.version: G713PV.334 dmi.board.asset.tag: ATN12345678901234567 dmi.board.name: G713PV dmi.board.vendor: ASUSTeK COMPUTER INC. dmi.board.version: 1.0 dmi.chassis.asset.tag: No Asset Tag dmi.chassis.type: 10 dmi.chassis.vendor: ASUSTeK COMPUTER INC. dmi.chassis.version: 1.0 dmi.ec.firmware.release: 0.69 dmi.modalias: dmi:bvnAmericanMegatrendsInternational,LLC.:bvrG713PV.334:bd09/03/2024:br5.29:efr0.69:svnASUSTeKCOMPUTERINC.:pnROGStrixG713PV_G713PV:pvr1.0:rvnASUSTeKCOMPUTERINC.:rnG713PV:rvr1.0:cvnASUSTeKCOMPUTERINC.:ct10:cvr1.0:sku: dmi.product.family: ROG Strix dmi.product.name: ROG Strix G713PV_G713PV dmi.product.version: 1.0 dmi.sys.vendor: ASUSTeK COMPUTER INC. ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Tags: amd64 apport-bug noble -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2166591 Title: Bluetooth stopped working after update To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2166591/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
