brcmfmac: NULL pointer dereference in brcmf_p2p_ifp_removed() after P2P device creation fails at boot (CM4)

Ouverte
  • Quelque chose ne va pas ?
#7,734 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
3/5
Temps estimé
1-2 jours
Accessibilité débutants
30/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Active
Stack technique
c, linux, raspberry-pi
Domaine
networking, operating-systems

Piste de recherche

The crash is in brcmf_p2p_ifp_removed() in the brcmfmac driver under drivers/net/wireless/broadcom/brcm80211/brcmfmac/, reached through brcmf_remove_interface() and brcmf_del_if(). Start by reading brcmf_p2p_create_p2pdev() and how it ignores the return value of brcmf_p2p_set_firmware(), then check whether brcmf_p2p_ifp_removed() can be reached with ifp->vif == NULL. Done means a NULL guard or proper error handling that avoids the oops, verified on hardware or by reasoning about the event path.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Describe the bug

At boot, when wpa_supplicant creates the P2P device interface p2p-dev-wlan0, the firmware sometimes does not answer brcmf_p2p_set_firmware() in time (ret -110). brcmf_p2p_create_p2pdev() then fails on p2p_disc and frees the vif. About 0.5 s later, the event worker handles an interface removal for this P2P device interface and calls brcmf_p2p_ifp_removed() with ifp->vif == NULL, which oopses.

After the oops, every program touching the network configuration (dhcpcd, wpa_supplicant, udevadm, sshd, chronyd) hangs in uninterruptible state, even on SIGKILL, until a power cycle.

Steps to reproduce the behaviour

Not reproducible on demand. Seen on 2 boots out of 20 on the same device (kernel logs from 04/10 to 02/11/2026):

  • 1 boot: ret -110, set p2p_disc error, add iface p2p-dev-wlan0 type 10 failed: err=-512, no oops.
  • 1 boot: same three lines, then the oops below.

Both were warm reboots (systemctl reboot and reboot). Not reproduced in 24 further warm reboots, 76 brcmfmac unload/reload cycles (with and without CPU/eMMC load) and 277 chip power cycles through WL_ON/BT_ON with SDIO rebind.

Wi-Fi is enabled but not configured (no network in wpa_supplicant.conf, phy0 soft-blocked by rfkill). wpa_supplicant is started by the dhcpcd hook.

Device (s)

Raspberry Pi CM4

System
  • Raspberry Pi OS (Debian 11.11, bullseye), image of 2023-05-03
  • Kernel 6.1.21-v8+ #1642 SMP PREEMPT Mon Apr 3 17:24:16 BST 2023 (raspberrypi-kernel 1:1.20230405-1)
  • Firmware BCM4345/6 wl0: Nov 1 2021 00:37:25 version 7.45.241 (1a2f2fa CY) FWID 01-703fd60 (firmware-brcm80211 1:20230210-5~bpo11+1+rpt2)
  • wpasupplicant 2:2.9.0-21+deb11u3, dhcpcd5 1:8.1.2-1+rpt9
Logs

[ 6.267960] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Nov 1 2021 00:37:25 version 7.45.241 (1a2f2fa CY) FWID 01-703fd60
[ 8.755390] ieee80211 phy0: brcmf_p2p_set_firmware: failed to update device address ret -110
[ 8.756319] ieee80211 phy0: brcmf_p2p_create_p2pdev: set p2p_disc error
[ 8.756347] ieee80211 phy0: brcmf_cfg80211_add_iface: add iface p2p-dev-wlan0 type 10 failed: err=-512
[ 9.288263] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
[ 9.288555] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
[ 9.288888] CPU: 1 PID: 53 Comm: kworker/1:1 Tainted: G C 6.1.21-v8+ #1642
[ 9.288915] Hardware name: Raspberry Pi Compute Module 4 Rev 1.1 (DT)
[ 9.288935] Workqueue: events brcmf_fweh_event_worker [brcmfmac]
[ 9.289029] pc : brcmf_p2p_ifp_removed+0x44/0xc0 [brcmfmac]
[ 9.289074] lr : brcmf_p2p_ifp_removed+0x40/0xc0 [brcmfmac]
[ 9.289204] x20: ffffffe0ae9bd0e8 x19: 0000000000000000 x18: 0000000000000000
[ 9.289372] Call trace:
[ 9.289382] brcmf_p2p_ifp_removed+0x44/0xc0 [brcmfmac]
[ 9.289427] brcmf_remove_interface+0x198/0x1f0 [brcmfmac]
[ 9.289470] brcmf_fweh_event_worker+0x370/0x518 [brcmfmac]
[ 9.289512] process_one_work+0x208/0x480
[ 9.289536] worker_thread+0x50/0x428
[ 9.289553] kthread+0xfc/0x110
[ 9.289567] ret_from_fork+0x10/0x20
[ 9.289586] Code: 910f4001 52800080 9400016f f9400673 (f9400660)
[ 10.814320] ieee80211 phy0: brcmf_p2p_create_p2pdev: timeout occurred
[ 10.814376] ieee80211 phy0: brcmf_cfg80211_add_iface: add iface p2p-dev-wlan0 type 10 failed: err=-5

Additional context

Analysis of the 6.1 sources (drivers/net/wireless/broadcom/brcm80211/brcmfmac/):

  • The faulting instructions are ldr x19, [x19, #8] (ifp->vif, gives x19 = 0) then ldr x0, [x19, #8] (vif->wdev.wiphy in wdev_to_cfg()), so brcmf_p2p_ifp_removed() was called with ifp->vif == NULL.
  • In brcmf_p2p_create_p2pdev(), the return value of brcmf_p2p_set_firmware() is ignored. When p2p_disc then fails, the vif event is disarmed and the vif freed, but the firmware may still send its interface events for the P2P device.
  • brcmf_fweh_handle_if_event() handles a BRCMF_E_IF_DEL nobody waits for with brcmf_remove_interface(ifp, false). For an interface without netdev, brcmf_del_if() calls brcmf_p2p_ifp_removed(), which dereferences ifp->vif without checking it.

This is my reading of the code, not a proven sequence. brcmf_p2p_ifp_removed(), brcmf_del_if() and brcmf_p2p_set_firmware() are unchanged in rpi-6.12.y and in mainline, and the BRCMF_E_IF_DEL default handling has the same logic, so the issue is likely still present in current kernels.

A possible fix: skip the P2P cleanup in brcmf_p2p_ifp_removed() when ifp->vif is NULL, and/or stop the P2P device creation when brcmf_p2p_set_firmware() fails.

Langage dominant
C
Étoiles
13.3k
Forks
5.5k
Merge moyen
1 j 4 h
PR mergées (30 j)
21

Préparer son environnement

Ce projet ne fournit ni conteneur de développement, ni Dockerfile, ni guide de contribution : l'installation est à votre charge. Commencez par son README, et consultez notre guide de la première contribution pour les étapes générales.

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de raspberrypi/linux

Toutes les issues de raspberrypi/linux

Issues similaires

Plus d'issues C

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.