brcmfmac: NULL pointer dereference in brcmf_p2p_ifp_removed() after P2P device creation fails at boot (CM4)

Aberta
  • Algo errado?
#7,734 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
3/5
Tempo estimado
1-2 dias
Facilidade para iniciantes
30/100
Tipo de issue
Bug
Clareza
Razoavelmente clara
Status de atividade
Ativa
Stack de tecnologia
c, linux, raspberry-pi
Domínio
networking, operating-systems

Direção de pesquisa

The crash is in brcmf_p2p_ifp_removed() in the brcmfmac driver under drivers/net/wireless/broadcom/brcm80211/brcmfmac/, reached through brcmf_remove_interface() and brcmf_del_if(). Start by reading brcmf_p2p_create_p2pdev() and how it ignores the return value of brcmf_p2p_set_firmware(), then check whether brcmf_p2p_ifp_removed() can be reached with ifp->vif == NULL. Done means a NULL guard or proper error handling that avoids the oops, verified on hardware or by reasoning about the event path.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Describe the bug

At boot, when wpa_supplicant creates the P2P device interface p2p-dev-wlan0, the firmware sometimes does not answer brcmf_p2p_set_firmware() in time (ret -110). brcmf_p2p_create_p2pdev() then fails on p2p_disc and frees the vif. About 0.5 s later, the event worker handles an interface removal for this P2P device interface and calls brcmf_p2p_ifp_removed() with ifp->vif == NULL, which oopses.

After the oops, every program touching the network configuration (dhcpcd, wpa_supplicant, udevadm, sshd, chronyd) hangs in uninterruptible state, even on SIGKILL, until a power cycle.

Steps to reproduce the behaviour

Not reproducible on demand. Seen on 2 boots out of 20 on the same device (kernel logs from 04/10 to 02/11/2026):

  • 1 boot: ret -110, set p2p_disc error, add iface p2p-dev-wlan0 type 10 failed: err=-512, no oops.
  • 1 boot: same three lines, then the oops below.

Both were warm reboots (systemctl reboot and reboot). Not reproduced in 24 further warm reboots, 76 brcmfmac unload/reload cycles (with and without CPU/eMMC load) and 277 chip power cycles through WL_ON/BT_ON with SDIO rebind.

Wi-Fi is enabled but not configured (no network in wpa_supplicant.conf, phy0 soft-blocked by rfkill). wpa_supplicant is started by the dhcpcd hook.

Device (s)

Raspberry Pi CM4

System
  • Raspberry Pi OS (Debian 11.11, bullseye), image of 2023-05-03
  • Kernel 6.1.21-v8+ #1642 SMP PREEMPT Mon Apr 3 17:24:16 BST 2023 (raspberrypi-kernel 1:1.20230405-1)
  • Firmware BCM4345/6 wl0: Nov 1 2021 00:37:25 version 7.45.241 (1a2f2fa CY) FWID 01-703fd60 (firmware-brcm80211 1:20230210-5~bpo11+1+rpt2)
  • wpasupplicant 2:2.9.0-21+deb11u3, dhcpcd5 1:8.1.2-1+rpt9
Logs

[ 6.267960] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Nov 1 2021 00:37:25 version 7.45.241 (1a2f2fa CY) FWID 01-703fd60
[ 8.755390] ieee80211 phy0: brcmf_p2p_set_firmware: failed to update device address ret -110
[ 8.756319] ieee80211 phy0: brcmf_p2p_create_p2pdev: set p2p_disc error
[ 8.756347] ieee80211 phy0: brcmf_cfg80211_add_iface: add iface p2p-dev-wlan0 type 10 failed: err=-512
[ 9.288263] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
[ 9.288555] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
[ 9.288888] CPU: 1 PID: 53 Comm: kworker/1:1 Tainted: G C 6.1.21-v8+ #1642
[ 9.288915] Hardware name: Raspberry Pi Compute Module 4 Rev 1.1 (DT)
[ 9.288935] Workqueue: events brcmf_fweh_event_worker [brcmfmac]
[ 9.289029] pc : brcmf_p2p_ifp_removed+0x44/0xc0 [brcmfmac]
[ 9.289074] lr : brcmf_p2p_ifp_removed+0x40/0xc0 [brcmfmac]
[ 9.289204] x20: ffffffe0ae9bd0e8 x19: 0000000000000000 x18: 0000000000000000
[ 9.289372] Call trace:
[ 9.289382] brcmf_p2p_ifp_removed+0x44/0xc0 [brcmfmac]
[ 9.289427] brcmf_remove_interface+0x198/0x1f0 [brcmfmac]
[ 9.289470] brcmf_fweh_event_worker+0x370/0x518 [brcmfmac]
[ 9.289512] process_one_work+0x208/0x480
[ 9.289536] worker_thread+0x50/0x428
[ 9.289553] kthread+0xfc/0x110
[ 9.289567] ret_from_fork+0x10/0x20
[ 9.289586] Code: 910f4001 52800080 9400016f f9400673 (f9400660)
[ 10.814320] ieee80211 phy0: brcmf_p2p_create_p2pdev: timeout occurred
[ 10.814376] ieee80211 phy0: brcmf_cfg80211_add_iface: add iface p2p-dev-wlan0 type 10 failed: err=-5

Additional context

Analysis of the 6.1 sources (drivers/net/wireless/broadcom/brcm80211/brcmfmac/):

  • The faulting instructions are ldr x19, [x19, #8] (ifp->vif, gives x19 = 0) then ldr x0, [x19, #8] (vif->wdev.wiphy in wdev_to_cfg()), so brcmf_p2p_ifp_removed() was called with ifp->vif == NULL.
  • In brcmf_p2p_create_p2pdev(), the return value of brcmf_p2p_set_firmware() is ignored. When p2p_disc then fails, the vif event is disarmed and the vif freed, but the firmware may still send its interface events for the P2P device.
  • brcmf_fweh_handle_if_event() handles a BRCMF_E_IF_DEL nobody waits for with brcmf_remove_interface(ifp, false). For an interface without netdev, brcmf_del_if() calls brcmf_p2p_ifp_removed(), which dereferences ifp->vif without checking it.

This is my reading of the code, not a proven sequence. brcmf_p2p_ifp_removed(), brcmf_del_if() and brcmf_p2p_set_firmware() are unchanged in rpi-6.12.y and in mainline, and the BRCMF_E_IF_DEL default handling has the same logic, so the issue is likely still present in current kernels.

A possible fix: skip the P2P cleanup in brcmf_p2p_ifp_removed() when ifp->vif is NULL, and/or stop the P2P device creation when brcmf_p2p_set_firmware() fails.

Linguagem predominante
C
Estrelas
13.3k
Forks
5.5k
Merge médio
1d 4h
PRs com merge (30d)
21

Preparar o ambiente

Este projeto não oferece contêiner de desenvolvimento, Dockerfile nem guia de contribuição, então a configuração fica por sua conta: comece pelo README e veja nosso guia da primeira contribuição para os passos gerais.

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de raspberrypi/linux

Todas as issues de raspberrypi/linux

Issues semelhantes

Mais issues de C

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.