Public bug reported:
Since noble kernel 6.8.0-139, Bluetooth on MediaTek MT7921 USB adapters no
longer
works. The kernel oopses during hci_power_on at every boot and hci0 stays in
`DOWN INIT` with BD address 00:00:00:00:00:00. bluetoothctl reports "No default
controller available".
- Last good kernel: 6.8.0-138-generic (Bluetooth works)
- First bad kernel: 6.8.0-139-generic
- Still broken in: 6.8.0-142-generic (drivers/bluetooth/btusb.c and btmtk.c are
identical in 139 and 142)
Hardware:
- ASUS Vivobook X1502ZA (BIOS X1502ZA.312 03/01/2023)
- MediaTek MT7921 combo chip; the Bluetooth side is USB 13d3:3563 (IMC
Networks),
and Wi-Fi uses mt7921e over PCI (Wi-Fi is not affected)
- Chip reports `HW/SW Version: 0x008a008a, Build Time: 20240219111427`
- linux-firmware-mediatek 20240318.git3b128b60-0ubuntu3.1, bluez 5.72-0ubuntu5.5
- Secure Boot disabled
### Oops (6.8.0-139-generic)
```
Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20240219111427
BUG: kernel NULL pointer dereference, address: 0000000000000219
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 2 PID: 139 Comm: kworker/u25:0 Not tainted 6.8.0-139-generic #139-Ubuntu
Hardware name: ASUSTeK COMPUTER INC. Vivobook_ASUSLaptop
X1502ZA_F1502ZA/X1502ZA, BIOS X1502ZA.312 03/01/2023
Workqueue: hci0 hci_power_on [bluetooth]
RIP: 0010:__pm_runtime_resume+0x1b/0x80
Call Trace:
<TASK>
usb_autopm_get_interface+0x1d/0x60
btmtk_usb_hci_wmt_sync+0xa9/0x2e0 [btmtk]
btmtk_setup_firmware_79xx+0x1c7/0x360 [btmtk]
btusb_mtk_setup+0x453/0x610 [btusb]
hci_dev_setup_sync+0x6c/0x430 [bluetooth]
hci_dev_init_sync+0x3e/0x1c0 [bluetooth]
hci_dev_open_sync+0xb1/0x350 [bluetooth]
hci_dev_do_open+0x28/0x70 [bluetooth]
hci_power_on+0x50/0x210 [bluetooth]
```
### Root cause
6.8.0-139 backported this series (from the 6.8.0-139.139 changelog):
- Bluetooth: btmtk: add the function to get the fw name
- Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset
- Bluetooth: btmtk: rename btmediatek_data
- Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c
- Bluetooth: btmtk: fix urb->setup_packet leak in error paths
After the backport, `btmtk_usb_hci_wmt_sync()` in btmtk.c reads its USB handles
from `struct btmtk_data` (`data->intf`, `data->udev`, `data->ctrl_anchor`).
Nothing in the noble tree ever assigns those fields: in
drivers/bluetooth/btusb.c,
`btusb_mtk_setup()` sets only `dev_id` and `reset_sync` on the btmtk_data
private
area. `data->intf` is therefore NULL, and `usb_autopm_get_interface(NULL)`
oopses.
Upstream assigns these fields in btusb_mtk_setup(), so it looks like that
assignment did not make it into the backport.
### Fix (tested)
Initialise the three fields in btusb_mtk_setup() before the first WMT command
(patch attached: 0001-btusb-mediatek-set-btmtk_data-usb-fields.patch):
```diff
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2974,6 +2974,10 @@
mediatek = hci_get_priv(hdev);
mediatek->dev_id = dev_id;
+ /* Needed by btmtk_usb_hci_wmt_sync() */
+ mediatek->intf = data->intf;
+ mediatek->udev = data->udev;
+ mediatek->ctrl_anchor = &data->ctrl_anchor;
mediatek->reset_sync = btusb_mtk_reset;
err = btmtk_register_coredump(hdev, btusb_driver.name, fw_version);
```
I built btusb.ko from the 6.8.0-142.142 linux-source with this change,
installed it
via DKMS and booted 6.8.0-142-generic. No oops occurred, hci0 came up `UP
RUNNING`
with the real BD address, and Bluetooth works normally.
Other MediaTek USB Bluetooth chips (MT7922, MT7925, MT7663/MT7668) share this
path,
so they are most likely affected too.
### Workarounds
- Boot 6.8.0-138-generic, or
- rebuild btusb with the patch above.
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: linux-image-6.8.0-142-generic 6.8.0-142.142
ProcVersionSignature: Ubuntu 6.8.0-142.142-generic 6.8.12
Uname: Linux 6.8.0-142-generic x86_64
ApportVersion: 2.28.3-0ubuntu0.1
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC0: ivan-mayal 2104 F.... wireplumber
/dev/snd/seq: ivan-mayal 2101 F.... pipewire
CRDA: N/A
CasperMD5CheckResult: unknown
CurrentDesktop: ubuntu:GNOME
Date: Sat Oct 3 11:15:08 2026
Lsusb:
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 002: ID 3277:0029 Shine-optics USB2.0 HD UVC WebCam
Bus 001 Device 003: ID 13d3:3563 IMC Networks Wireless_Device
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
MachineType: ASUSTeK COMPUTER INC. Vivobook_ASUSLaptop X1502ZA_F1502ZA
ProcEnviron:
LANG=es_ES.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
ProcFB: 0 i915drmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.8.0-142-generic
root=UUID=222fb4cc-e986-47b2-bab9-3222a517adce ro quiet splash vt.handoff=7
PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No
PulseAudio daemon running, or not running as session daemon.
RelatedPackageVersions:
linux-restricted-modules-6.8.0-142-generic N/A
linux-backports-modules-6.8.0-142-generic N/A
linux-firmware 20240318.git3b128b60.0ubuntu3.1
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
WifiSyslog:
dmi.bios.date: 03/01/2023
dmi.bios.release: 5.26
dmi.bios.vendor: American Megatrends International, LLC.
dmi.bios.version: X1502ZA.312
dmi.board.asset.tag: ATN12345678901234567
dmi.board.name: X1502ZA
dmi.board.vendor: ASUSTeK COMPUTER INC.
dmi.board.version: 1.0
dmi.chassis.asset.tag: No Asset Tag
dmi.chassis.type: 10
dmi.chassis.vendor: ASUSTeK COMPUTER INC.
dmi.chassis.version: 1.0
dmi.modalias:
dmi:bvnAmericanMegatrendsInternational,LLC.:bvrX1502ZA.312:bd03/01/2023:br5.26:svnASUSTeKCOMPUTERINC.:pnVivobook_ASUSLaptopX1502ZA_F1502ZA:pvr1.0:rvnASUSTeKCOMPUTERINC.:rnX1502ZA:rvr1.0:cvnASUSTeKCOMPUTERINC.:ct10:cvr1.0:sku:
dmi.product.family: Vivobook
dmi.product.name: Vivobook_ASUSLaptop X1502ZA_F1502ZA
dmi.product.version: 1.0
dmi.sys.vendor: ASUSTeK COMPUTER INC.
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug noble
** Patch added: "0001-btusb-mediatek-set-btmtk_data-usb-fields.patch"
https://bugs.launchpad.net/bugs/2169397/+attachment/6005181/+files/0001-btusb-mediatek-set-btmtk_data-usb-fields.patch
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169397
Title:
btusb/btmtk: NULL pointer dereference in btmtk_usb_hci_wmt_sync on
MT7921 USB Bluetooth since 6.8.0-139 (regression)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169397/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
