Re: [regression] mt76x2u: NULL pointer dereference since recent change to fix chanctx emulation for monitor mode

[ZeroBeat <ZeroBeat@xxxxxx>]

I've added several debug printk - no luck, yet.

Regards
Mike


Am 25.07.24 um 17:57 schrieb Lorenzo Bianconi:
> > Just to mention it here. The regression has now reached the longterm kernel:
> > affected devices: mt76 series (not affected mt7601u)
> >
> >
> > before update:
> > $ uname -r
> > 6.6.40-2-lts
> >
> > $ sudo hcxdumptool -i wlp5s0f4u2 --rcascan=active
> > ^C
> > 38 Packet(s) captured by kernel
> > 0 Packet(s) dropped by kernel
> > 14 PROBERESPONSE(s) captured
> >
> > exit on sigterm
> >
> >
> >
> > after update:
> > $ uname -r
> > 6.6.41-1-lts
> >
> > $ sudo hcxdumptool -i wlp48s0f4u2u1 --rcascan=active
> > ^C
> > 0 Packet(s) captured by kernel
> > 0 Packet(s) dropped by kernel
> > Warning: too less packets received (monitor mode may not work as expected)
> > Possible reasons:
> >   no transmitter in range
> >   frames are filtered out by BPF
> >   driver is broken
> > Warning: no PROBERESPONSES received (frame injection may not work as expected)
> > Possible reasons:
> >   no AP in range
> >   frames are filtered out by BPF
> >   driver is broken
> >   driver does not support frame injection
> >
> > exit on sigterm
> >
> >
> > Best regards
> > Mike
>
> Hi,
>
> I am looking into it. I will get back to you.
>
> Regards,
> Lorenzo
>
> > Am 24.07.24 um 10:47 schrieb Johannes Berg:
> > > On Wed, 2024-07-24 at 09:58 +0200, Linux regression tracking (Thorsten
> > > Leemhuis) wrote:
> > > > Hi, Thorsten here, the Linux kernel's regression tracker.
> > > >
> > > > Johannes, Felix, Lorenzo, Ryder, I noticed a report about a regression
> > > > in bugzilla.kernel.org that (for my untrained eyes) appears to be a bug
> > > > in some code paths of mt76x2u that was exposed by 0d9c2beed116e6 ("wifi:
> > > > mac80211: fix monitor channel with chanctx emulation") [v6.10-rc5,
> > > > v6.9.7] from Johannes.
> > > >
> > > > As many (most?) kernel developers don't keep an eye on the bug tracker,
> > > > I decided to write this mail. To quote from
> > > > https://bugzilla.kernel.org/show_bug.cgi?id=219086 :
> > > >
> > > > >    Michael 2024-07-23 15:38:43 UTC
> > > > >
> > > > > After a user opened this discussion:
> > > > > https://github.com/ZerBea/hcxdumptool/discussions/465
> > > > >
> > > > > Jul 21 05:40:39 rpi4b-aarch kernel: mt76x2u 2-2:1.0 wlan1: entered promiscuous mode
> > > > > Jul 21 05:40:45 rpi4b-aarch kernel: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
> > > > > Jul 21 05:40:45 rpi4b-aarch kernel: Mem abort info:
> > > > > Jul 21 05:40:45 rpi4b-aarch kernel:   ESR = 0x0000000096000044
> > > > > Jul 21 05:40:45 rpi4b-aarch kernel:   EC = 0x25: DABT (current EL), IL = 32 bits
> > > > > Jul 21 05:40:45 rpi4b-aarch kernel:   SET = 0, FnV = 0
> > > > > Jul 21 05:40:45 rpi4b-aarch kernel:   EA = 0, S1PTW = 0
> > > > > Jul 21 05:40:45 rpi4b-aarch kernel:   FSC = 0x04: level 0 translation fault
> > > > > Jul 21 05:40:45 rpi4b-aarch kernel: Data abort info:
> > > > > Jul 21 05:40:45 rpi4b-aarch kernel:   ISV = 0, ISS = 0x00000044, ISS2 = 0x00000000
> > > > > Jul 21 05:40:45 rpi4b-aarch kernel:   CM = 0, WnR = 1, TnD = 0, TagAccess = 0
> > > > > Jul 21 05:40:45 rpi4b-aarch kernel:   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> > > > > Jul 21 05:40:45 rpi4b-aarch kernel: user pgtable: 4k pages, 48-bit VAs, pgdp=0000000041300000
> > >
> > > Not too well-versed with ARM, does that tel me anything about where in
> > > the code the crash was? Without any further information I don't think I
> > > can see anything here, and I don't have an affected device.
> > >
> > > johannes

Attachment: OpenPGP_0x375516A45DB88630.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature