Public bug reported:
On Raspberry Pi 5 running linux-raspi with a MediaTek MT7612U USB Wi-Fi adapter
(0e8d:7612, driver mt76x2u, used as an access point), the kernel periodically
reports a UBSAN array-index-out-of-bounds in mac80211 minstrel_ht rate control:
UBSAN: array-index-out-of-bounds in
/build/linux-raspi-pll8yV/linux-raspi-7.0.0/net/mac80211/rc80211_minstrel_ht.c:409:33
index 15 is out of range for type 'minstrel_rate_stats [10]'
CPU: 3 UID: 0 PID: 55 Comm: kworker/u16:4 Not tainted 7.0.0-1020-raspi
#20-Ubuntu PREEMPT(lazy)
Hardware name: Raspberry Pi 5 Model B Rev 1.1 (DT)
Workqueue: mt76 mt76u_tx_status_data [mt76_usb]
Call trace:
show_stack+0x20/0x38 (C)
dump_stack_lvl+0x7c/0xa0
dump_stack+0x18/0x2c
ubsan_epilogue+0x10/0x48
__ubsan_handle_out_of_bounds+0x90/0xc0
minstrel_ht_tx_status+0x924/0xcf0 [mac80211]
rate_control_tx_status+0x9c/0x120 [mac80211]
ieee80211_tx_status_ext+0x2d0/0x630 [mac80211]
mt76_tx_status_unlock+0x154/0x230 [mt76]
mt76x02_send_tx_status+0x164/0x3e8 [mt76x02_lib]
mt76x02_tx_status_data+0x60/0xa0 [mt76x02_lib]
mt76u_tx_status_data+0x88/0x120 [mt76_usb]
process_one_work+0x194/0x570
worker_thread+0x194/0x320
kthread+0x10c/0x128
ret_from_fork+0x10/0x20
Observed on:
7.0.0-1016-raspi (2026-09-01) and 7.0.0-1020-raspi (2026-10-12), two separate
Raspberry Pi 5 units.
About once per week per device under light AP load. The AP keeps running; no
panic (panic_on_warn not set).
Firmware mt7662u.bin is the latest in linux-firmware-mediatek.
Root cause and upstream fix: mt76x02_mac_process_tx_rate() takes the rate index
from the hardware TX-status word without a bounds check for HT/HT_GF/VHT, and
mt76x02_mac_fill_tx_status() ignores its return value, so a stale or corrupt
index reaches minstrel_ht, whose per-group array has 10 entries
(MCS_GROUP_RATES). Upstream patch, marked for stable:
"[PATCH wireless v2] wifi: mt76: mt76x02: validate TX-status rate index before
mac80211 handoff" (Mark Anthony Agarro, 2026-08-26), Fixes: 7c1f88812690
("mt76: unify send_tx_status and related helpers"), Cc: [email protected].
https://lists.infradead.org/pipermail/linux-mediatek/2026-August/112226.html
The same trace is reported against the generic 7.0 kernel with MT7612U at
https://github.com/morrownr/mt76/issues/88 .
Request: please pick up the patch (or its stable backport) for linux-raspi in
resolute. This adapter is used as the access point in a product we intend to
ship on this kernel.
Steps to reproduce: run an MT7612U as a hostapd AP on linux-raspi 7.0 and serve
normal client traffic; the trace appears in dmesg within days.
** Affects: linux-raspi (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171439
Title:
linux-raspi: UBSAN array-index-out-of-bounds in minstrel_ht_tx_status
via mt76x02u (MT7612U) - please backport "wifi: mt76: mt76x02:
validate TX-status rate index before mac80211 handoff"
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux-raspi/+bug/2171439/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
