From: "Linus Lüssing" <linus.luessing@c0d3.blue>
To: linux-bluetooth@vger.kernel.org, linux-wireless@vger.kernel.org,
Intel Linux Wireless <linuxwifi@intel.com>
Cc: Emmanuel Grumbach <emmanuel.grumbach@intel.com>,
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>,
Marcel Holtmann <marcel@holtmann.org>
Subject: Re: Crash / Null pointer dereference in l2cap_chan_send()
Date: Mon, 2 May 2022 11:05:42 +0200 [thread overview]
Message-ID: <Ym+exknyLoxOZqFe@sellars> (raw)
In-Reply-To: <20201110205950.GF2423@otheros>
On Tue, Nov 10, 2020 at 09:59:50PM +0100, Linus Lüssing wrote:
> On Tue, Nov 10, 2020 at 07:20:39AM +0100, Linus Lüssing wrote:
> > [...]
> >
> > The issue was introduced with the following commit:
> >
> > f4bfdc5e571e ("iwlwifi: mvm: stop supporting swcrypto and bt_coex_active module parameters")
> > * first affected tag: v5.8-rc1
> >
>
> PS: As this commit mentioned bt_coex_active, I retried with a
> vanilla 5.9.6 kernel while leaving bt_coex_active at its
> default value. That is leaving it enabled while all previous tests
> I did had it disabled.
>
> However I still get the Bluetooth A2DP freeze and subsequent
> kernel panics.
> [...]
I did a few more tests and found out that it was the old iwlwifi
firmware causing the kernel panics for me when Bluetooth co-existence
is enabled.
With firmware-iwlwifi_20170823-1_all.deb on Debian I can reproduce
the issue, with firmware-iwlwifi_20180518-1~bpo9+1_all.deb or
firmware-iwlwifi_20210818-1_all.deb I can't.
Also, I can still reproduce the kernel panic with firmware-iwlwifi at
version 20170823-1 and with a recent Linux kernel on Debian Sid
(linux-image-5.17.0-1-amd64, 5.17.3-1). So nothing which has fixed
it in the upstream kernel since v5.8-rc1.
I'm a bit surprised that a non-free firmware can create kernel
panics in "random" code paths. But maybe that's expected as
whatever is running the iwlwifi firmware has access to more memory
areas than I would like it to have? Let me know if I should dig
deeper, if there is something that should/could be fixed in the
upstream, opensource iwlwifi driver to prevent such kernel panics.
Regards, Linus
PS: firmware-iwlwifi_20170823-1_all.deb seems unavailable on Debian
at the moment, even the archives. But I found a copy in the Kali
Linux archives:
http://old.kali.org/kali/pool/non-free/f/firmware-nonfree/firmware-iwlwifi_20170823-1_all.deb
prev parent reply other threads:[~2022-05-02 9:15 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-10 6:20 Crash / Null pointer dereference in l2cap_chan_send() Linus Lüssing
2020-11-10 20:59 ` Linus Lüssing
2022-05-02 9:05 ` Linus Lüssing [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Ym+exknyLoxOZqFe@sellars \
--to=linus.luessing@c0d3.blue \
--cc=emmanuel.grumbach@intel.com \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=linuxwifi@intel.com \
--cc=luiz.von.dentz@intel.com \
--cc=marcel@holtmann.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.