apport information
** Tags added: apport-collected arm64-image raspi-image resolute
** Description changed:
On Raspberry Pi 5 running linux-raspi with a MediaTek MT7612U USB Wi-Fi
adapter (0e8d:7612, driver mt76x2u, used as an access point), the kernel
periodically reports a UBSAN array-index-out-of-bounds in mac80211 minstrel_ht
rate control:
UBSAN: array-index-out-of-bounds in
/build/linux-raspi-pll8yV/linux-raspi-7.0.0/net/mac80211/rc80211_minstrel_ht.c:409:33
index 15 is out of range for type 'minstrel_rate_stats [10]'
CPU: 3 UID: 0 PID: 55 Comm: kworker/u16:4 Not tainted 7.0.0-1020-raspi
#20-Ubuntu PREEMPT(lazy)
Hardware name: Raspberry Pi 5 Model B Rev 1.1 (DT)
Workqueue: mt76 mt76u_tx_status_data [mt76_usb]
Call trace:
show_stack+0x20/0x38 (C)
dump_stack_lvl+0x7c/0xa0
dump_stack+0x18/0x2c
ubsan_epilogue+0x10/0x48
__ubsan_handle_out_of_bounds+0x90/0xc0
minstrel_ht_tx_status+0x924/0xcf0 [mac80211]
rate_control_tx_status+0x9c/0x120 [mac80211]
ieee80211_tx_status_ext+0x2d0/0x630 [mac80211]
mt76_tx_status_unlock+0x154/0x230 [mt76]
mt76x02_send_tx_status+0x164/0x3e8 [mt76x02_lib]
mt76x02_tx_status_data+0x60/0xa0 [mt76x02_lib]
mt76u_tx_status_data+0x88/0x120 [mt76_usb]
process_one_work+0x194/0x570
worker_thread+0x194/0x320
kthread+0x10c/0x128
ret_from_fork+0x10/0x20
Observed on:
7.0.0-1016-raspi (2026-09-01) and 7.0.0-1020-raspi (2026-10-12), two separate
Raspberry Pi 5 units.
About once per week per device under light AP load. The AP keeps running; no
panic (panic_on_warn not set).
Firmware mt7662u.bin is the latest in linux-firmware-mediatek.
Root cause and upstream fix: mt76x02_mac_process_tx_rate() takes the rate
index from the hardware TX-status word without a bounds check for HT/HT_GF/VHT,
and mt76x02_mac_fill_tx_status() ignores its return value, so a stale or
corrupt index reaches minstrel_ht, whose per-group array has 10 entries
(MCS_GROUP_RATES). Upstream patch, marked for stable:
"[PATCH wireless v2] wifi: mt76: mt76x02: validate TX-status rate index
before mac80211 handoff" (Mark Anthony Agarro, 2026-08-26), Fixes: 7c1f88812690
("mt76: unify send_tx_status and related helpers"), Cc: [email protected].
https://lists.infradead.org/pipermail/linux-mediatek/2026-August/112226.html
The same trace is reported against the generic 7.0 kernel with MT7612U at
https://github.com/morrownr/mt76/issues/88 .
Request: please pick up the patch (or its stable backport) for linux-raspi in
resolute. This adapter is used as the access point in a product we intend to
ship on this kernel.
Steps to reproduce: run an MT7612U as a hostapd AP on linux-raspi 7.0 and
serve normal client traffic; the trace appears in dmesg within days.
+ ---
+ ProblemType: Bug
+ AlsaVersion: Advanced Linux Sound Architecture Driver Version
k7.0.0-1020-raspi.
+ AplayDevices: Error: [Errno 2] No such file or directory: 'aplay'
+ ApportVersion: 2.34.1-0ubuntu0.1
+ Architecture: arm64
+ ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord'
+ AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/by-path',
'/dev/snd/controlC1', '/dev/snd/pcmC1D0p', '/dev/snd/controlC0',
'/dev/snd/pcmC0D0p', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1:
+ Card0.Amixer.info: Error: [Errno 2] No such file or directory: 'amixer'
+ Card0.Amixer.values: Error: [Errno 2] No such file or directory: 'amixer'
+ Card1.Amixer.info: Error: [Errno 2] No such file or directory: 'amixer'
+ Card1.Amixer.values: Error: [Errno 2] No such file or directory: 'amixer'
+ CasperMD5CheckResult: unknown
+ CurrentDmesg: Error: command ['dmesg'] failed with exit code 1: dmesg: read
kernel buffer failed: Operation not permitted
+ DistroRelease: Ubuntu 26.04
+ ImageMediaBuild: 20260826
+ IwDevWlan0Link: Not connected.
+ IwDevWlx90de8033a226Link: Not connected.
+ Lspci-vt:
+ -[0001:00]---00.0-[01]----00.0 MAXIO Technology (Hangzhou) Ltd. NVMe SSD
Controller MAP1202 (DRAM-less)
+ -[0002:00]---00.0-[01]----00.0 Raspberry Pi Ltd RP1 PCIe 2.0 South Bridge
+ Package: linux-raspi (not installed)
+ PciMultimedia:
+
+ ProcEnviron:
+ LANG=C.UTF-8
+ PATH=(custom, no user)
+ SHELL=/bin/bash
+ TERM=xterm-256color
+ XDG_RUNTIME_DIR=<set>
+ ProcFB:
+
+ ProcKernelCmdLine: reboot=w coherent_pool=1M 8250.nr_uarts=1
pci=pcie_bus_safe numa_policy=interleave nvme.max_host_mem_size_mb=0
numa=fake=4 system_heap.max_order=0 iommu_dma_numa_policy=interleave
smsc95xx.macaddr=98:FE:54:0A:25:9B vc_mem.mem_base=0x3fc00000
vc_mem.mem_size=0x40000000 console=ttyAMA0,115200 multipath=off
dwc_otg.lpm_enable=0 console=tty1 root=LABEL=writable rootfstype=ext4 panic=10
rootwait fixrtc
+ ProcVersionSignature: User Name 7.0.0-1020.20-raspi 7.0.14
+ SourcePackage: linux-raspi
+ Tags: arm64-image raspi-image resolute
+ Uname: Linux 7.0.0-1020-raspi aarch64
+ UpgradeStatus: No upgrade log present (probably fresh install)
+ UserGroups: adm cdrom dip lxd sudo
+ _MarkForUpload: True
+ acpidump:
** Attachment added: "AlsaDevices.txt"
https://bugs.launchpad.net/bugs/2171439/+attachment/6010736/+files/AlsaDevices.txt
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171439
Title:
linux-raspi: UBSAN array-index-out-of-bounds in minstrel_ht_tx_status
via mt76x02u (MT7612U) - please backport "wifi: mt76: mt76x02:
validate TX-status rate index before mac80211 handoff"
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux-raspi/+bug/2171439/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
