Search Linux Wireless

Re: patch 46/47 causes NULL pointer deref on mt7921

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Am Donnerstag, dem 11.07.2024 um 18:40 -0500 schrieb Sean Wang:
> Hi Bert,
>
> Thanks for the detailed debug log. I've quickly made a change to fix
> the issue. Right now, I can't access the test environment, but I'll
> test it and send it out as soon as possible. Here's the patch.
>
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
> b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
> index 2e6268cb06c0..1bab93d049df 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
> @@ -303,6 +303,7 @@ mt7921_add_interface(struct ieee80211_hw *hw,
> struct ieee80211_vif *vif)
>
>         mvif->bss_conf.mt76.omac_idx = mvif->bss_conf.mt76.idx;
>         mvif->phy = phy;
> +       mvif->bss_conf.vif = mvif;
>         mvif->bss_conf.mt76.band_idx = 0;
>         mvif->bss_conf.mt76.wmm_idx = mvif->bss_conf.mt76.idx %
> MT76_CONNAC_MAX_WMM_SETS;
>

I wrote earlier that this patch works fine with linux-next-20240711 and at first
it did, but then another NULL pointer error occured. I'm not sure if I can
bisect this as it does not trigger automatically it seems. Also I'm currently
bisecting the problem with linux-20240712

Bert Karwatzki

[  T853] BUG: kernel NULL pointer dereference, address: 0000000000000008
[  T853] #PF: supervisor read access in kernel mode
[  T853] #PF: error_code(0x0000) - not-present page
[  T853] PGD 0 P4D 0
[  T853] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
[  T853] CPU: 7 UID: 0 PID: 853 Comm: NetworkManager Not tainted 6.10.0-rc7-
next-20240711-debug-dirty #32
[  T853] Hardware name: Micro-Star International Co., Ltd. Alpha 15 B5EEK/MS-
158L, BIOS E158LAMS.107 11/10/2021
[  T853] RIP: 0010:mt7921_ipv6_addr_change+0x3b/0x1d0 [mt7921_common]
[  T853] Code: 68 02 00 00 41 54 4c 89 ef 53 48 89 d3 48 83 e4 f0 48 83 ec 60 65
48 8b 04 25 28 00 00 00 48 89 44 24 58 48 8b 86 70 09 00 00 <4c> 8b 60 08 0f b6
86 90 04 00 00 48 c7 44 24 05 00 00 00 00 88 44
[  T853] RSP: 0018:ffffb1d203ef35e0 EFLAGS: 00010282
[  T853] RAX: 0000000000000000 RBX: ffff8c73c1ada000 RCX: 0000000000000000
[  T853] RDX: ffff8c73c1ada000 RSI: ffff8c73849d9990 RDI: ffff8c73c1ada268
[  T853] RBP: ffffb1d203ef3668 R08: ffff8c73c19703c0 R09: 0000000000000000
[  T853] R10: ffffb1d203ef36b0 R11: 0000000000000000 R12: 0000000000000002
[  T853] R13: ffff8c73c1ada268 R14: 00000000ffffffff R15: ffff8c73846b08d8
[  T853] FS:  00007f640a9e6500(0000) GS:ffff8c822e5c0000(0000)
knlGS:0000000000000000
[  T853] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  T853] CR2: 0000000000000008 CR3: 00000001043e0000 CR4: 0000000000750ef0
[  T853] PKRU: 55555554
[  T853] Call Trace:
[  T853]  <TASK>
[  T853]  ? __die+0x1e/0x60
[  T853]  ? page_fault_oops+0x157/0x450
[  T853]  ? srso_alias_return_thunk+0x5/0xfbef5
[  T853]  ? pollwake+0x73/0xa0
[  T853]  ? wake_up_state+0x10/0x10
[  T853]  ? exc_page_fault+0x331/0x670
[  T853]  ? asm_exc_page_fault+0x26/0x30
[  T853]  ? mt7921_ipv6_addr_change+0x3b/0x1d0 [mt7921_common]
[  T853]  ? srso_alias_return_thunk+0x5/0xfbef5
[  T853]  ? __ipv6_ifa_notify+0x16f/0x4d0
[  T853]  ? ieee80211_ifa6_changed+0x5e/0x70 [mac80211]
[  T853]  ? atomic_notifier_call_chain+0x51/0x80
[  T853]  ? addrconf_ifdown.isra.0+0x43f/0x810
[  T853]  ? srso_alias_return_thunk+0x5/0xfbef5
[  T853]  ? addrconf_notify+0x15d/0x760
[  T853]  ? __timer_delete_sync+0x70/0xd0
[  T853]  ? raw_notifier_call_chain+0x43/0x60
[  T853]  ? __dev_notify_flags+0x91/0xf0
[  T853]  ? dev_change_flags+0x4f/0x60
[  T853]  ? do_setlink+0xdf9/0x11d0
[  T853]  ? __skb_flow_dissect+0xc30/0x1a40
[  T853]  ? drain_stock+0x63/0xa0
[  T853]  ? srso_alias_return_thunk+0x5/0xfbef5
[  T853]  ? __nla_validate_parse+0x61/0xd10
[  T853]  ? srso_alias_return_thunk+0x5/0xfbef5
[  T853]  ? update_load_avg+0x77/0x6d0
[  T853]  ? __rtnl_newlink+0x5d6/0x980
[  T853]  ? __entry_text_end+0x102398/0x10239b
[  T853]  ? srso_alias_return_thunk+0x5/0xfbef5
[  T853]  ? kmem_cache_alloc_node_noprof+0x4c/0x220
[  T853]  ? srso_alias_return_thunk+0x5/0xfbef5
[  T853]  ? srso_alias_return_thunk+0x5/0xfbef5
[  T853]  ? __kmalloc_cache_noprof+0x44/0x210
[  T853]  ? rtnl_newlink+0x42/0x60
[  T853]  ? rtnetlink_rcv_msg+0x152/0x3f0
[  T853]  ? srso_alias_return_thunk+0x5/0xfbef5
[  T853]  ? netlink_unicast+0x238/0x290
[  T853]  ? rtnl_calcit.isra.0+0x130/0x130
[  T853]  ? netlink_rcv_skb+0x56/0x100
[  T853]  ? netlink_unicast+0x199/0x290
[  T853]  ? netlink_sendmsg+0x21d/0x490
[  T853]  ? __sock_sendmsg+0x78/0x80
[  T853]  ? ____sys_sendmsg+0x23f/0x2e0
[  T853]  ? srso_alias_return_thunk+0x5/0xfbef5
[  T853]  ? copy_msghdr_from_user+0x68/0xa0
[  T853]  ? ___sys_sendmsg+0x81/0xd0
[  T853]  ? srso_alias_return_thunk+0x5/0xfbef5
[  T853]  ? crng_fast_key_erasure+0xbc/0xf0
[  T853]  ? srso_alias_return_thunk+0x5/0xfbef5
[  T853]  ? get_random_bytes_user+0x126/0x140
[  T853]  ? srso_alias_return_thunk+0x5/0xfbef5
[  T853]  ? __fdget+0xb1/0xe0
[  T853]  ? __sys_sendmsg+0x56/0xa0
[  T853]  ? srso_alias_return_thunk+0x5/0xfbef5
[  T853]  ? do_syscall_64+0x5f/0x170
[  T853]  ? entry_SYSCALL_64_after_hwframe+0x55/0x5d
[  T853]  </TASK>
[  T853] Modules linked in: ccm snd_seq_dummy snd_hrtimer snd_seq_midi
snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device rfcomm cmac bnep nls_ascii
nls_cp437 vfat fat snd_ctl_led snd_hda_codec_realtek snd_hda_codec_generic
snd_hda_scodec_component snd_hda_codec_hdmi btusb btrtl btintel snd_hda_intel
btbcm btmtk snd_intel_dspcfg snd_hda_codec snd_soc_dmic snd_acp3x_pdm_dma
snd_acp3x_rn bluetooth snd_soc_core uvcvideo snd_hwdep snd_hda_core
videobuf2_vmalloc uvc videobuf2_memops videobuf2_v4l2 snd_pcm_oss videodev
snd_mixer_oss snd_pcm snd_rn_pci_acp3x hid_sensor_gyro_3d hid_sensor_magn_3d
hid_sensor_accel_3d hid_sensor_als hid_sensor_prox snd_acp_config
videobuf2_common snd_timer hid_sensor_trigger msi_wmi snd_soc_acpi ecdh_generic
amd_atl ecc mc snd edac_mce_amd wmi_bmof sparse_keymap ccp soundcore k10temp
snd_pci_acp3x button industrialio_triggered_buffer battery joydev ac kfifo_buf
industrialio hid_sensor_iio_common amd_pmc evdev hid_multitouch serio_raw
mt7921e mt7921_common mt792x_lib mt76_connac_lib mt76
[  T853]  mac80211 libarc4 cfg80211 rfkill msr fuse nvme_fabrics efi_pstore
configfs efivarfs autofs4 ext4 crc32c_generic mbcache jbd2 usbhid amdgpu
i2c_algo_bit drm_ttm_helper ttm drm_exec xhci_pci drm_suballoc_helper amdxcp
drm_buddy xhci_hcd gpu_sched hid_sensor_hub drm_display_helper usbcore nvme
mfd_core hid_generic crc32c_intel psmouse amd_sfh i2c_piix4 usb_common crc16
nvme_core r8169 i2c_hid_acpi i2c_hid hid i2c_designware_platform
i2c_designware_core
[  T853] CR2: 0000000000000008
[  T853] ---[ end trace 0000000000000000 ]---






[Index of Archives]     [Linux Host AP]     [ATH6KL]     [Linux Wireless Personal Area Network]     [Linux Bluetooth]     [Wireless Regulations]     [Linux Netdev]     [Kernel Newbies]     [Linux Kernel]     [IDE]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite Hiking]     [MIPS Linux]     [ARM Linux]     [Linux RAID]

  Powered by Linux