brcmfmac: NULL pointer dereference in brcmf_p2p_ifp_removed() after P2P device creation fails at boot (CM4)

The crash is in brcmf_p2p_ifp_removed() in the brcmfmac driver under drivers/net/wireless/broadcom/brcm80211/brcmfmac/, reached through brcmf_remove_interface() and brcmf_del_if(). Start by reading brcmf_p2p_create_p2pdev() and how it ignores the return value of brcmf_p2p_set_firmware(), then check whether brcmf_p2p_ifp_removed() can be reached with ifp->vif == NULL. Done means a NULL guard or proper error handling that avoids the oops, verified on hardware or by reasoning about the event path.

Describe the bug

At boot, when wpa_supplicant creates the P2P device interface p2p-dev-wlan0, the firmware sometimes does not answer brcmf_p2p_set_firmware() in time (ret -110). brcmf_p2p_create_p2pdev() then fails on p2p_disc and frees the vif. About 0.5 s later, the event worker handles an interface removal for this P2P device interface and calls brcmf_p2p_ifp_removed() with ifp->vif == NULL, which oopses.

After the oops, every program touching the network configuration (dhcpcd, wpa_supplicant, udevadm, sshd, chronyd) hangs in uninterruptible state, even on SIGKILL, until a power cycle.

Steps to reproduce the behaviour

Not reproducible on demand. Seen on 2 boots out of 20 on the same device (kernel logs from 04/10 to 02/11/2026):

• 1 boot: ret -110, set p2p_disc error, add iface p2p-dev-wlan0 type 10 failed: err=-512, no oops.
• 1 boot: same three lines, then the oops below.

Both were warm reboots (systemctl reboot and reboot). Not reproduced in 24 further warm reboots, 76 brcmfmac unload/reload cycles (with and without CPU/eMMC load) and 277 chip power cycles through WL_ON/BT_ON with SDIO rebind.

Wi-Fi is enabled but not configured (no network in wpa_supplicant.conf, phy0 soft-blocked by rfkill). wpa_supplicant is started by the dhcpcd hook.

Device (s)

Raspberry Pi CM4

System

• Raspberry Pi OS (Debian 11.11, bullseye), image of 2023-05-03
• Kernel 6.1.21-v8+ #1642 SMP PREEMPT Mon Apr 3 17:24:16 BST 2023 (raspberrypi-kernel 1:1.20230405-1)
• Firmware BCM4345/6 wl0: Nov 1 2021 00:37:25 version 7.45.241 (1a2f2fa CY) FWID 01-703fd60 (firmware-brcm80211 1:20230210-5~bpo11+1+rpt2)
• wpasupplicant 2:2.9.0-21+deb11u3, dhcpcd5 1:8.1.2-1+rpt9

Logs

[ 6.267960] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Nov 1 2021 00:37:25 version 7.45.241 (1a2f2fa CY) FWID 01-703fd60
[ 8.755390] ieee80211 phy0: brcmf_p2p_set_firmware: failed to update device address ret -110
[ 8.756319] ieee80211 phy0: brcmf_p2p_create_p2pdev: set p2p_disc error
[ 8.756347] ieee80211 phy0: brcmf_cfg80211_add_iface: add iface p2p-dev-wlan0 type 10 failed: err=-512
[ 9.288263] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
[ 9.288555] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
[ 9.288888] CPU: 1 PID: 53 Comm: kworker/1:1 Tainted: G C 6.1.21-v8+ #1642
[ 9.288915] Hardware name: Raspberry Pi Compute Module 4 Rev 1.1 (DT)
[ 9.288935] Workqueue: events brcmf_fweh_event_worker [brcmfmac]
[ 9.289029] pc : brcmf_p2p_ifp_removed+0x44/0xc0 [brcmfmac]
[ 9.289074] lr : brcmf_p2p_ifp_removed+0x40/0xc0 [brcmfmac]
[ 9.289204] x20: ffffffe0ae9bd0e8 x19: 0000000000000000 x18: 0000000000000000
[ 9.289372] Call trace:
[ 9.289382] brcmf_p2p_ifp_removed+0x44/0xc0 [brcmfmac]
[ 9.289427] brcmf_remove_interface+0x198/0x1f0 [brcmfmac]
[ 9.289470] brcmf_fweh_event_worker+0x370/0x518 [brcmfmac]
[ 9.289512] process_one_work+0x208/0x480
[ 9.289536] worker_thread+0x50/0x428
[ 9.289553] kthread+0xfc/0x110
[ 9.289567] ret_from_fork+0x10/0x20
[ 9.289586] Code: 910f4001 52800080 9400016f f9400673 (f9400660)
[ 10.814320] ieee80211 phy0: brcmf_p2p_create_p2pdev: timeout occurred
[ 10.814376] ieee80211 phy0: brcmf_cfg80211_add_iface: add iface p2p-dev-wlan0 type 10 failed: err=-5

Additional context

Analysis of the 6.1 sources (drivers/net/wireless/broadcom/brcm80211/brcmfmac/):

• The faulting instructions are ldr x19, [x19, #8] (ifp->vif, gives x19 = 0) then ldr x0, [x19, #8] (vif->wdev.wiphy in wdev_to_cfg()), so brcmf_p2p_ifp_removed() was called with ifp->vif == NULL.
• In brcmf_p2p_create_p2pdev(), the return value of brcmf_p2p_set_firmware() is ignored. When p2p_disc then fails, the vif event is disarmed and the vif freed, but the firmware may still send its interface events for the P2P device.
• brcmf_fweh_handle_if_event() handles a BRCMF_E_IF_DEL nobody waits for with brcmf_remove_interface(ifp, false). For an interface without netdev, brcmf_del_if() calls brcmf_p2p_ifp_removed(), which dereferences ifp->vif without checking it.

This is my reading of the code, not a proven sequence. brcmf_p2p_ifp_removed(), brcmf_del_if() and brcmf_p2p_set_firmware() are unchanged in rpi-6.12.y and in mainline, and the BRCMF_E_IF_DEL default handling has the same logic, so the issue is likely still present in current kernels.

A possible fix: skip the P2P cleanup in brcmf_p2p_ifp_removed() when ifp->vif is NULL, and/or stop the P2P device creation when brcmf_p2p_set_firmware() fails.