Hi everyone,
I looked into the NULL pointer dereference in btmtk on kernel
6.8.0-139-generic and confirmed the root cause.
[ Impact ]
On Ubuntu 24.04 LTS (Noble), upgrading to linux-image-6.8.0-139-generic breaks
Bluetooth on machines with MediaTek MT7921 and MT7961 combo adapters (USB ID
0e8d:0608). During boot and firmware loading, the kernel hits a NULL pointer
dereference inside usb_autopm_get_interface(), triggering a fatal kernel Oops
and leaving the hci0 adapter dead in DOWN INIT state with a null MAC address
00:00:00:00:00:00.
[ Fix ]
In kernel 6.8.0-139, the refactoring commit d019930b0049 ("Bluetooth: btmtk:
move btusb_mtk_hci_wmt_sync to btmtk.c") moved the synchronous WMT command
execution from btusb.c into btmtk.c.
While struct btmtk_data in btmtk.h was given fields for udev, intf, and
ctrl_anchor, btusb.c was not updated to set these pointers in
btusb_mtk_setup(). When btmtk_usb_hci_wmt_sync() runs, it calls
usb_autopm_get_interface(data->intf). Because data->intf is NULL,
pm_runtime_resume_and_get(&intf->dev) tries to access dev.power at
offset 0x219 from NULL, triggering:
BUG: kernel NULL pointer dereference, address: 0000000000000219
RIP: 0010:__pm_runtime_resume+0x1b/0x80
Call Trace:
usb_autopm_get_interface+0x1d/0x60
btmtk_usb_hci_wmt_sync+0xa9/0x2e0 [btmtk]
btmtk_setup_firmware_79xx+0x1c7/0x360 [btmtk]
btusb_mtk_setup+0x453/0x610 [btusb]
The fix does two things:
1. In btusb.c (btusb_mtk_setup), initialize mediatek->udev = data->udev;,
mediatek->intf = data->intf;, and mediatek->ctrl_anchor = &data->ctrl_anchor;.
2. In btmtk.c (btmtk_usb_hci_wmt_sync), add a defensive guard at the start of
the function:
if (!data || !data->intf || !data->udev) {
bt_dev_err(hdev, "WMT sync failed: uninitialized USB context\n");
return -ENODEV;
}
[ Test Plan ]
We reproduced this on a dedicated Noble testbed running kernel
6.8.0-139-generic under QEMU/KVM:
1. Boot unpatched kernel 6.8.0-139-generic and trigger the MediaTek WMT sync
path.
- Result: 100% reproducible crash at __pm_runtime_resume+0x1b/0x80 (CR2:
0000000000000219), kernel panic.
2. Apply the patch and rebuild btmtk.ko and btusb.ko.
3. Boot patched kernel 6.8.0-139-generic and run the same test.
- Result: No crash, no Oops. If called with uninitialized context, it
cleanly returns -ENODEV. With initialized context, firmware loading proceeds
and the adapter comes up normally.
[ Where problems could occur ]
The change is small and strictly restricted to MediaTek Bluetooth USB setup. It
only assigns existing USB pointers (udev, intf, ctrl_anchor) from btusb_data
into btmtk_data, and adds a check preventing NULL dereferences. Non-MediaTek
adapters (Intel, Realtek, Broadcom, Qualcomm) do not execute this code path and
are completely unaffected.
[ Other Info ]
Attached is the clean DEP-3 patch: lp2167679_btmtk_null_deref.patch.
Also attached are console logs from the testbed:
- lp2167679_repro_before_fix.log (showing the 6.8.0-139 Oops)
- lp2167679_verify_after_fix.log (showing clean execution with patch)
** Patch added: "Fix NULL pointer dereference in btmtk/btusb for MT7921"
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2167679/+attachment/6001146/+files/lp2167679_btmtk_null_deref.patch
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167679
Title:
btmtk: NULL pointer dereference in usb_autopm_get_interface during
MT7921 firmware setup on 6.8.0-139
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2167679/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
