apport information ** Tags added: apport-collected noble
** Description changed: I encountered a kernel panic in the in-tree `brcmfmac` driver while a Broadcom BCM43602 PCIe wireless interface (`wlp2s0`) was attached to a Linux bridge (`br0`). The panic occurred on September 8, 2026 at approximately 10:18 JST. ### System Hardware: * Apple MacBookPro14,2 * Broadcom BCM43602 PCIe WLAN, PCI ID 14e4:43ba Kernel that crashed: * `7.0.0-30-generic` * `#30~24.04.1-Ubuntu` * PREEMPT(lazy) * Kernel was reported as `Not tainted` The system has since been upgraded to `7.0.0-31-generic`. I have not yet established whether the problem is reproducible on `7.0.0-31`. ### Actual result The system displayed a kernel panic and stopped. Since `kernel.panic=0`, I manually rebooted the system. EFI pstore successfully preserved the Oops/panic records. The initial exception was: ``` BUG: kernel NULL pointer dereference, address: 000000000000001c #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page Oops: 0002 [#1] SMP PTI RIP: __raw_spin_lock_irqsave+0x27/0x80 ``` Relevant call trace: ``` _raw_spin_lock_irqsave skb_queue_tail brcmf_flowring_enqueue [brcmfmac] brcmf_msgbuf_tx_queue_data [brcmfmac] brcmf_netdev_start_xmit [brcmfmac] xmit_one.constprop.0 dev_hard_start_xmit sch_direct_xmit __dev_xmit_skb __dev_queue_xmit br_dev_queue_push_xmit [bridge] br_forward_finish [bridge] __br_forward [bridge] br_forward [bridge] br_handle_frame_finish [bridge] br_handle_frame [bridge] ``` This subsequently resulted in: ``` Kernel panic - not syncing: Fatal exception in interrupt ``` At the point of the fault, CR2 was `0x1c`, and RDI/RBX also contained `0x1c`. This appears consistent with `brcmf_flowring_enqueue()` attempting to operate on an invalid or NULL flow-ring object while queuing an skb. I suspect a race or lifetime problem involving flow-ring lookup/deletion and the TX path, but this is only an analysis hypothesis. ### Network setup `wlp2s0`, driven by `brcmfmac`, was being used as a port of Linux bridge `br0`. This machine is also used for hostapd/bridge testing. Prior to the crash, the interface had been repeatedly added to/removed from the bridge and used in AP-related tests. Kernel logs earlier in the same boot contain messages including: ``` brcmf_cfg80211_start_ap: Set Channel failed: ... -52 brcmf_run_escan: error (-52) brcmf_cfg80211_scan: scan error (-52) brcmf_escan_timeout: timer expired ``` I am attaching the relevant bridge/hostapd configuration and kernel logs. Secrets such as SSIDs and PSKs have been redacted. ### Reproducibility Observed once so far as a kernel panic. I am continuing to test with Ubuntu kernel `7.0.0-31-generic`. ### Expected result Forwarding traffic through a bridge containing `wlp2s0` must not dereference a NULL/invalid flow ring or panic the kernel. ### Attachments * EFI pstore Oops * EFI pstore panic * kernel log from the crashed boot * `lspci -vvnnk` * BCM43602/`brcmfmac` information * firmware information * bridge configuration * hostapd version/configuration with credentials redacted + --- + ProblemType: Bug + ApportVersion: 2.28.3-0ubuntu0.1 + Architecture: amd64 + AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/by-path', '/dev/snd/controlC0', '/dev/snd/hwC0D2', '/dev/snd/hwC0D0', '/dev/snd/pcmC0D8p', '/dev/snd/pcmC0D7p', '/dev/snd/pcmC0D3p', '/dev/snd/pcmC0D0c', '/dev/snd/pcmC0D0p', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1: + CasperMD5CheckMismatches: ./boot/grub/grub.cfg ./boot/grub/loopback.cfg + CasperMD5CheckResult: fail + DistroRelease: Ubuntu 24.04 + InstallationDate: Installed on 2026-07-02 (70 days ago) + InstallationMedia: Ubuntu 24.04 LTS "Noble Numbat" - Release amd64 (20240424) + MachineType: Apple Inc. MacBookPro14,2 + Package: linux (not installed) + ProcEnviron: + LANG=ja_JP.UTF-8 + PATH=(custom, no user) + SHELL=/bin/bash + TERM=xterm-256color + XDG_RUNTIME_DIR=<set> + ProcFB: 0 i915drmfb + ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-31-generic root=UUID=ad77f8ab-75ed-4334-851e-c252d708d757 ro verbose + ProcVersionSignature: Ubuntu 7.0.0-31.31~24.04.1-generic 7.0.14 + RelatedPackageVersions: + linux-restricted-modules-7.0.0-31-generic N/A + linux-backports-modules-7.0.0-31-generic N/A + linux-firmware 20240318.git3b128b60.0ubuntu3.1 + Tags: noble + Uname: Linux 7.0.0-31-generic x86_64 + UpgradeStatus: No upgrade log present (probably fresh install) + UserGroups: adm cdrom dip lpadmin plugdev sudo users + _MarkForUpload: True + dmi.bios.date: 06/23/2024 + dmi.bios.release: 0.1 + dmi.bios.vendor: Apple Inc. + dmi.bios.version: 529.140.2.0.0 + dmi.board.name: Mac-CAD6701F7CEA0921 + dmi.board.vendor: Apple Inc. + dmi.board.version: MacBookPro14,2 + dmi.chassis.type: 9 + dmi.chassis.vendor: Apple Inc. + dmi.chassis.version: Mac-CAD6701F7CEA0921 + dmi.modalias: dmi:bvnAppleInc.:bvr529.140.2.0.0:bd06/23/2024:br0.1:svnAppleInc.:pnMacBookPro14,2:pvr1.0:rvnAppleInc.:rnMac-CAD6701F7CEA0921:rvrMacBookPro14,2:cvnAppleInc.:ct9:cvrMac-CAD6701F7CEA0921:sku:pfaMacBookPro: + dmi.product.family: MacBook Pro + dmi.product.name: MacBookPro14,2 + dmi.product.version: 1.0 + dmi.sys.vendor: Apple Inc. ** Attachment added: "AlsaInfo.txt" https://bugs.launchpad.net/bugs/2166724/+attachment/5999110/+files/AlsaInfo.txt -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2166724 Title: brcmfmac: NULL pointer dereference in brcmf_flowring_enqueue() during bridge forwarding causes kernel panic on BCM43602 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2166724/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
