Public bug reported:
I encountered a kernel panic in the in-tree `brcmfmac` driver while a
Broadcom BCM43602 PCIe wireless interface (`wlp2s0`) was attached to a
Linux bridge (`br0`).
The panic occurred on September 8, 2026 at approximately 10:18 JST.
### System
Hardware:
* Apple MacBookPro14,2
* Broadcom BCM43602 PCIe WLAN, PCI ID 14e4:43ba
Kernel that crashed:
* `7.0.0-30-generic`
* `#30~24.04.1-Ubuntu`
* PREEMPT(lazy)
* Kernel was reported as `Not tainted`
The system has since been upgraded to `7.0.0-31-generic`. I have not yet
established whether the problem is reproducible on `7.0.0-31`.
### Actual result
The system displayed a kernel panic and stopped. Since `kernel.panic=0`,
I manually rebooted the system.
EFI pstore successfully preserved the Oops/panic records.
The initial exception was:
```
BUG: kernel NULL pointer dereference, address: 000000000000001c
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
Oops: 0002 [#1] SMP PTI
RIP: __raw_spin_lock_irqsave+0x27/0x80
```
Relevant call trace:
```
_raw_spin_lock_irqsave
skb_queue_tail
brcmf_flowring_enqueue [brcmfmac]
brcmf_msgbuf_tx_queue_data [brcmfmac]
brcmf_netdev_start_xmit [brcmfmac]
xmit_one.constprop.0
dev_hard_start_xmit
sch_direct_xmit
__dev_xmit_skb
__dev_queue_xmit
br_dev_queue_push_xmit [bridge]
br_forward_finish [bridge]
__br_forward [bridge]
br_forward [bridge]
br_handle_frame_finish [bridge]
br_handle_frame [bridge]
```
This subsequently resulted in:
```
Kernel panic - not syncing: Fatal exception in interrupt
```
At the point of the fault, CR2 was `0x1c`, and RDI/RBX also contained
`0x1c`.
This appears consistent with `brcmf_flowring_enqueue()` attempting to
operate on an invalid or NULL flow-ring object while queuing an skb. I
suspect a race or lifetime problem involving flow-ring lookup/deletion
and the TX path, but this is only an analysis hypothesis.
### Network setup
`wlp2s0`, driven by `brcmfmac`, was being used as a port of Linux bridge
`br0`.
This machine is also used for hostapd/bridge testing. Prior to the
crash, the interface had been repeatedly added to/removed from the
bridge and used in AP-related tests. Kernel logs earlier in the same
boot contain messages including:
```
brcmf_cfg80211_start_ap: Set Channel failed: ... -52
brcmf_run_escan: error (-52)
brcmf_cfg80211_scan: scan error (-52)
brcmf_escan_timeout: timer expired
```
I am attaching the relevant bridge/hostapd configuration and kernel
logs. Secrets such as SSIDs and PSKs have been redacted.
### Reproducibility
Observed once so far as a kernel panic.
I am continuing to test with Ubuntu kernel `7.0.0-31-generic`.
### Expected result
Forwarding traffic through a bridge containing `wlp2s0` must not
dereference a NULL/invalid flow ring or panic the kernel.
### Attachments
* EFI pstore Oops
* EFI pstore panic
* kernel log from the crashed boot
* `lspci -vvnnk`
* BCM43602/`brcmfmac` information
* firmware information
* bridge configuration
* hostapd version/configuration with credentials redacted
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Attachment added: "brcmfmac-panic-20260908.tar"
https://bugs.launchpad.net/bugs/2166724/+attachment/5998457/+files/brcmfmac-panic-20260908.tar
** Description changed:
I encountered a kernel panic in the in-tree `brcmfmac` driver while a
Broadcom BCM43602 PCIe wireless interface (`wlp2s0`) was attached to a
Linux bridge (`br0`).
The panic occurred on September 8, 2026 at approximately 10:18 JST.
### System
Hardware:
* Apple MacBookPro14,2
* Broadcom BCM43602 PCIe WLAN, PCI ID 14e4:43ba
Kernel that crashed:
* `7.0.0-30-generic`
* `#30~24.04.1-Ubuntu`
* PREEMPT(lazy)
* Kernel was reported as `Not tainted`
The system has since been upgraded to `7.0.0-31-generic`. I have not yet
established whether the problem is reproducible on `7.0.0-31`.
### Actual result
The system displayed a kernel panic and stopped. Since `kernel.panic=0`,
I manually rebooted the system.
EFI pstore successfully preserved the Oops/panic records.
The initial exception was:
```
BUG: kernel NULL pointer dereference, address: 000000000000001c
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
Oops: 0002 [#1] SMP PTI
RIP: __raw_spin_lock_irqsave+0x27/0x80
```
Relevant call trace:
```
_raw_spin_lock_irqsave
skb_queue_tail
brcmf_flowring_enqueue [brcmfmac]
brcmf_msgbuf_tx_queue_data [brcmfmac]
brcmf_netdev_start_xmit [brcmfmac]
xmit_one.constprop.0
dev_hard_start_xmit
sch_direct_xmit
__dev_xmit_skb
__dev_queue_xmit
br_dev_queue_push_xmit [bridge]
br_forward_finish [bridge]
__br_forward [bridge]
br_forward [bridge]
br_handle_frame_finish [bridge]
br_handle_frame [bridge]
```
This subsequently resulted in:
```
Kernel panic - not syncing: Fatal exception in interrupt
```
At the point of the fault, CR2 was `0x1c`, and RDI/RBX also contained
`0x1c`.
This appears consistent with `brcmf_flowring_enqueue()` attempting to
operate on an invalid or NULL flow-ring object while queuing an skb. I
suspect a race or lifetime problem involving flow-ring lookup/deletion
and the TX path, but this is only an analysis hypothesis.
### Network setup
`wlp2s0`, driven by `brcmfmac`, was being used as a port of Linux bridge
`br0`.
This machine is also used for hostapd/bridge testing. Prior to the
crash, the interface had been repeatedly added to/removed from the
bridge and used in AP-related tests. Kernel logs earlier in the same
boot contain messages including:
```
brcmf_cfg80211_start_ap: Set Channel failed: ... -52
brcmf_run_escan: error (-52)
brcmf_cfg80211_scan: scan error (-52)
brcmf_escan_timeout: timer expired
```
I am attaching the relevant bridge/hostapd configuration and kernel
logs. Secrets such as SSIDs and PSKs have been redacted.
### Reproducibility
Observed once so far as a kernel panic.
- I am continuing to test with Ubuntu kernel `7.0.0-31-generic`. I can
- also test an upstream mainline kernel if requested.
+ I am continuing to test with Ubuntu kernel `7.0.0-31-generic`.
### Expected result
Forwarding traffic through a bridge containing `wlp2s0` must not
dereference a NULL/invalid flow ring or panic the kernel.
### Attachments
* EFI pstore Oops
* EFI pstore panic
* kernel log from the crashed boot
* `lspci -vvnnk`
* BCM43602/`brcmfmac` information
* firmware information
* bridge configuration
* hostapd version/configuration with credentials redacted
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2166724
Title:
brcmfmac: NULL pointer dereference in brcmf_flowring_enqueue() during
bridge forwarding causes kernel panic on BCM43602
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2166724/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
