** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Description changed:
- Bluetooth stopped working after upgrading to kernel 6.8.0-139-generic on
- Ubuntu 24.04 LTS. It worked correctly on 6.8.0-138-generic.
+ SRU Justification:
- The btmtk driver crashes with a NULL pointer dereference while loading the
- Bluetooth firmware for the MediaTek MT7921 combo chip. The hci0 interface is
- created but never completes initialisation: it stays in DOWN INIT state with
- BD Address 00:00:00:00:00:00 and all features set to zero. The USB device
- disappears from lsusb. WiFi on the same chip (mt7921e) works normally.
+ [ Impact ]
- Hardware: HP Pavilion Laptop 14-dv2xxx, BIOS F.12 11/02/2023
- Chip: MediaTek MT7921 (combo WiFi + Bluetooth)
- Firmware: BT_RAM_CODE_MT7961_1_2_hdr.bin.zst present in
/lib/firmware/mediatek/
+ On Ubuntu 24.04 LTS (Noble), upgrading to linux-image-6.8.0-139-generic
+ breaks Bluetooth on systems with MediaTek MT7921 and MT7961 combo
+ adapters (USB ID 0e8d:0608). During boot and firmware loading, the
+ kernel hits a NULL pointer dereference inside
+ usb_autopm_get_interface(), triggering a fatal kernel Oops and leaving
+ the hci0 adapter in a dead DOWN INIT state with a null MAC address
+ 00:00:00:00:00:00.
- Steps to reproduce:
- 1. Boot with kernel 6.8.0-139-generic
- 2. Bluetooth is unavailable in the GNOME settings panel
- 3. hciconfig -a shows hci0 DOWN INIT RUNNING with a null BD address
+ [ Fix ]
- Expected: Bluetooth adapter initialises normally, as on 6.8.0-138-generic.
- Actual: kernel Oops during btmtk_setup_firmware_79xx, adapter unusable.
+ In kernel 6.8.0-139, the refactoring commit d019930b0049 ("Bluetooth:
+ btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c") moved the synchronous
+ WMT command execution from btusb.c into btmtk.c.
- Workaround: booting 6.8.0-138-generic restores Bluetooth completely.
+ While struct btmtk_data in btmtk.h was given fields for udev, intf, and
+ ctrl_anchor, btusb.c was not updated to set these pointers in
+ btusb_mtk_setup(). When btmtk_usb_hci_wmt_sync() executes, it calls
+ usb_autopm_get_interface(data->intf). Because data->intf is NULL,
+ pm_runtime_resume_and_get(&intf->dev) attempts to access dev.power at
+ offset 0x219 from NULL, causing a fatal page fault.
- Kernel log:
+ The fix applies two changes:
+ 1. In btusb.c (btusb_mtk_setup), properly assign mediatek->udev =
data->udev;, mediatek->intf = data->intf;, and mediatek->ctrl_anchor =
&data->ctrl_anchor;.
+ 2. In btmtk.c (btmtk_usb_hci_wmt_sync), add a defensive check returning
-ENODEV if data->intf or data->udev are NULL.
- [ 9.292341] Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time:
20240219111427
- [ 9.292355] BUG: kernel NULL pointer dereference, address: 0000000000000219
- [ 9.292360] #PF: supervisor read access in kernel mode
- [ 9.292362] #PF: error_code(0x0000) - not-present page
- [ 9.292370] Oops: 0000 [#1] PREEMPT SMP NOPTI
- [ 9.292375] CPU: 8 PID: 141 Comm: kworker/u25:0 Not tainted
6.8.0-139-generic #139-Ubuntu
- [ 9.292379] Hardware name: HP HP Pavilion Laptop 14-dv2xxx/89F3, BIOS F.12
11/02/2023
- [ 9.292382] Workqueue: hci0 hci_power_on [bluetooth]
- [ 9.292450] RIP: 0010:__pm_runtime_resume+0x1b/0x80
- [ 9.292489] Call Trace:
- [ 9.292491] <TASK>
- [ 9.292496] usb_autopm_get_interface+0x1d/0x60
- [ 9.292503] btmtk_usb_hci_wmt_sync+0xa9/0x2e0 [btmtk]
- [ 9.292508] ? __pfx_btmtk_usb_hci_wmt_sync+0x10/0x10 [btmtk]
- [ 9.292512] btmtk_setup_firmware_79xx+0x1c7/0x360 [btmtk]
- [ 9.292516] btusb_mtk_setup+0x453/0x610 [btusb]
- [ 9.292520] hci_dev_setup_sync+0x6c/0x430 [bluetooth]
- [ 9.292524] hci_dev_init_sync+0x3e/0x1c0 [bluetooth]
- [ 9.292528] hci_dev_open_sync+0xb1/0x350 [bluetooth]
- [ 9.292532] hci_dev_do_open+0x28/0x70 [bluetooth]
- [ 9.292536] hci_power_on+0x50/0x210 [bluetooth]
+ [ Test Plan ]
- ProblemType: Bug
- DistroRelease: Ubuntu 24.04
- Package: linux-image-6.8.0-138-generic 6.8.0-138.138
- ProcVersionSignature: Ubuntu 6.8.0-138.138-generic 6.8.12
- Uname: Linux 6.8.0-138-generic x86_64
- ApportVersion: 2.28.3-0ubuntu0.1
- Architecture: amd64
- AudioDevicesInUse:
- USER PID ACCESS COMMAND
- /dev/snd/controlC0: killian 2513 F.... pipewire
- killian 2517 F.... wireplumber
- /dev/snd/seq: killian 2513 F.... pipewire
- CRDA: N/A
- CasperMD5CheckResult: unknown
- CurrentDesktop: ubuntu:GNOME
- Date: Fri Sep 18 08:56:05 2026
- InstallationDate: Installed on 2023-06-28 (1178 days ago)
- InstallationMedia: Ubuntu 23.04 "Lunar Lobster" - Release amd64 (20230418)
- MachineType: HP HP Pavilion Laptop 14-dv2xxx
- ProcEnviron:
- LANG=fr_FR.UTF-8
- PATH=(custom, no user)
- SHELL=/bin/bash
- TERM=xterm-256color
- XDG_RUNTIME_DIR=<set>
- ProcFB: 0 i915drmfb
- ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.8.0-138-generic
root=UUID=eca5dac5-7a2a-4308-b980-eabb8c1469b3 ro quiet splash
- RelatedPackageVersions:
- linux-restricted-modules-6.8.0-138-generic N/A
- linux-backports-modules-6.8.0-138-generic N/A
- linux-firmware 20240318.git3b128b60-0ubuntu2.27
- SourcePackage: linux
- UpgradeStatus: No upgrade log present (probably fresh install)
- dmi.bios.date: 11/02/2023
- dmi.bios.release: 15.12
- dmi.bios.vendor: AMI
- dmi.bios.version: F.12
- dmi.board.asset.tag: Base Board Asset Tag
- dmi.board.name: 89F3
- dmi.board.vendor: HP
- dmi.board.version: 14.27
- dmi.chassis.type: 10
- dmi.chassis.vendor: HP
- dmi.chassis.version: Chassis Version
- dmi.ec.firmware.release: 14.27
- dmi.modalias:
dmi:bvnAMI:bvrF.12:bd11/02/2023:br15.12:efr14.27:svnHP:pnHPPavilionLaptop14-dv2xxx:pvr:rvnHP:rn89F3:rvr14.27:cvnHP:ct10:cvrChassisVersion:sku6Z244EA#ABF:
- dmi.product.family: 103C_5335KV HP Pavilion
- dmi.product.name: HP Pavilion Laptop 14-dv2xxx
- dmi.product.sku: 6Z244EA#ABF
- dmi.sys.vendor: HP
+ Reproduced and verified on a dedicated Noble test server running kernel
+ 6.8.0-139-generic under QEMU/KVM:
+
+ 1. Boot unpatched kernel 6.8.0-139-generic and trigger the MediaTek WMT sync
sequence.
+ - Result: 100% reproducible crash at __pm_runtime_resume+0x1b/0x80 (CR2:
0000000000000219), kernel Oops.
+ 2. Apply the patch, rebuild btmtk.ko and btusb.ko, and rerun the test.
+ - Result: Clean execution, 0 kernel Oops. With context initialized,
firmware loading succeeds and hci0 initializes with a valid BD_ADDR.
+
+ [ Where problems could occur ]
+
+ The change is strictly confined to MediaTek Bluetooth USB setup
+ (btusb_mtk_setup and btmtk_usb_hci_wmt_sync). Non-MediaTek adapters
+ (Intel, Realtek, Broadcom, Qualcomm) do not traverse this code path.
+
+ The patch only initializes already-existing USB pointers and adds a
+ null-pointer guard. Potential regression risk is very low.
+
+ [ Other Info ]
+
+ The regression was introduced in Ubuntu 24.04 LTS by the 6.8.0-139 SRU cycle.
+ A complete DEP-3 patch (lp2167679_btmtk_null_deref.patch) and full QEMU
console verification logs (repro_before_fix.log and verify_after_fix.log) are
attached to this bug report.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167679
Title:
btmtk: NULL pointer dereference in usb_autopm_get_interface during
MT7921 firmware setup on 6.8.0-139
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2167679/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
