brcmfmac: NULL pointer dereference in brcmf_p2p_ifp_removed() after P2P device creation fails at boot (CM4)

Abierto
  • ¿Algo no está bien?
#7,734 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
30/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
c, linux, raspberry-pi
Área
networking, operating-systems

Línea de trabajo

The crash is in brcmf_p2p_ifp_removed() in the brcmfmac driver under drivers/net/wireless/broadcom/brcm80211/brcmfmac/, reached through brcmf_remove_interface() and brcmf_del_if(). Start by reading brcmf_p2p_create_p2pdev() and how it ignores the return value of brcmf_p2p_set_firmware(), then check whether brcmf_p2p_ifp_removed() can be reached with ifp->vif == NULL. Done means a NULL guard or proper error handling that avoids the oops, verified on hardware or by reasoning about the event path.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Describe the bug

At boot, when wpa_supplicant creates the P2P device interface p2p-dev-wlan0, the firmware sometimes does not answer brcmf_p2p_set_firmware() in time (ret -110). brcmf_p2p_create_p2pdev() then fails on p2p_disc and frees the vif. About 0.5 s later, the event worker handles an interface removal for this P2P device interface and calls brcmf_p2p_ifp_removed() with ifp->vif == NULL, which oopses.

After the oops, every program touching the network configuration (dhcpcd, wpa_supplicant, udevadm, sshd, chronyd) hangs in uninterruptible state, even on SIGKILL, until a power cycle.

Steps to reproduce the behaviour

Not reproducible on demand. Seen on 2 boots out of 20 on the same device (kernel logs from 04/10 to 02/11/2026):

  • 1 boot: ret -110, set p2p_disc error, add iface p2p-dev-wlan0 type 10 failed: err=-512, no oops.
  • 1 boot: same three lines, then the oops below.

Both were warm reboots (systemctl reboot and reboot). Not reproduced in 24 further warm reboots, 76 brcmfmac unload/reload cycles (with and without CPU/eMMC load) and 277 chip power cycles through WL_ON/BT_ON with SDIO rebind.

Wi-Fi is enabled but not configured (no network in wpa_supplicant.conf, phy0 soft-blocked by rfkill). wpa_supplicant is started by the dhcpcd hook.

Device (s)

Raspberry Pi CM4

System
  • Raspberry Pi OS (Debian 11.11, bullseye), image of 2023-05-03
  • Kernel 6.1.21-v8+ #1642 SMP PREEMPT Mon Apr 3 17:24:16 BST 2023 (raspberrypi-kernel 1:1.20230405-1)
  • Firmware BCM4345/6 wl0: Nov 1 2021 00:37:25 version 7.45.241 (1a2f2fa CY) FWID 01-703fd60 (firmware-brcm80211 1:20230210-5~bpo11+1+rpt2)
  • wpasupplicant 2:2.9.0-21+deb11u3, dhcpcd5 1:8.1.2-1+rpt9
Logs

[ 6.267960] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Nov 1 2021 00:37:25 version 7.45.241 (1a2f2fa CY) FWID 01-703fd60
[ 8.755390] ieee80211 phy0: brcmf_p2p_set_firmware: failed to update device address ret -110
[ 8.756319] ieee80211 phy0: brcmf_p2p_create_p2pdev: set p2p_disc error
[ 8.756347] ieee80211 phy0: brcmf_cfg80211_add_iface: add iface p2p-dev-wlan0 type 10 failed: err=-512
[ 9.288263] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
[ 9.288555] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
[ 9.288888] CPU: 1 PID: 53 Comm: kworker/1:1 Tainted: G C 6.1.21-v8+ #1642
[ 9.288915] Hardware name: Raspberry Pi Compute Module 4 Rev 1.1 (DT)
[ 9.288935] Workqueue: events brcmf_fweh_event_worker [brcmfmac]
[ 9.289029] pc : brcmf_p2p_ifp_removed+0x44/0xc0 [brcmfmac]
[ 9.289074] lr : brcmf_p2p_ifp_removed+0x40/0xc0 [brcmfmac]
[ 9.289204] x20: ffffffe0ae9bd0e8 x19: 0000000000000000 x18: 0000000000000000
[ 9.289372] Call trace:
[ 9.289382] brcmf_p2p_ifp_removed+0x44/0xc0 [brcmfmac]
[ 9.289427] brcmf_remove_interface+0x198/0x1f0 [brcmfmac]
[ 9.289470] brcmf_fweh_event_worker+0x370/0x518 [brcmfmac]
[ 9.289512] process_one_work+0x208/0x480
[ 9.289536] worker_thread+0x50/0x428
[ 9.289553] kthread+0xfc/0x110
[ 9.289567] ret_from_fork+0x10/0x20
[ 9.289586] Code: 910f4001 52800080 9400016f f9400673 (f9400660)
[ 10.814320] ieee80211 phy0: brcmf_p2p_create_p2pdev: timeout occurred
[ 10.814376] ieee80211 phy0: brcmf_cfg80211_add_iface: add iface p2p-dev-wlan0 type 10 failed: err=-5

Additional context

Analysis of the 6.1 sources (drivers/net/wireless/broadcom/brcm80211/brcmfmac/):

  • The faulting instructions are ldr x19, [x19, #8] (ifp->vif, gives x19 = 0) then ldr x0, [x19, #8] (vif->wdev.wiphy in wdev_to_cfg()), so brcmf_p2p_ifp_removed() was called with ifp->vif == NULL.
  • In brcmf_p2p_create_p2pdev(), the return value of brcmf_p2p_set_firmware() is ignored. When p2p_disc then fails, the vif event is disarmed and the vif freed, but the firmware may still send its interface events for the P2P device.
  • brcmf_fweh_handle_if_event() handles a BRCMF_E_IF_DEL nobody waits for with brcmf_remove_interface(ifp, false). For an interface without netdev, brcmf_del_if() calls brcmf_p2p_ifp_removed(), which dereferences ifp->vif without checking it.

This is my reading of the code, not a proven sequence. brcmf_p2p_ifp_removed(), brcmf_del_if() and brcmf_p2p_set_firmware() are unchanged in rpi-6.12.y and in mainline, and the BRCMF_E_IF_DEL default handling has the same logic, so the issue is likely still present in current kernels.

A possible fix: skip the P2P cleanup in brcmf_p2p_ifp_removed() when ifp->vif is NULL, and/or stop the P2P device creation when brcmf_p2p_set_firmware() fails.

Lenguaje dominante
C
Estrellas
13.3k
Forks
5.5k
Merge medio
1 d 4 h
PR fusionados (30 d)
21

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de raspberrypi/linux

Todos los issues de raspberrypi/linux

Issues similares

Más issues de C

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.