[Solved] 6.12 Kernel btusb NULL pointer dereference on AMD

tsukimomo · 2024-12-17 09:11:58

Found this tracked upstream, but the comment with the git commit in the `bluetooth-next` tree is not something I know how to determine as being in the existing ArchLinux 6.12.X kernels; and am not sure if I should add more details onto the bugzilla.

Digging out from older journalctls, on my AMD Ryzen 5 5500U machine with a `MEDIATEK Corp. MT7921 802.11ax PCI Express Wireless Network Adapter`, after logging through SDDM we have the following

Dec 17 11:29:36 archlin kernel: BUG: kernel NULL pointer dereference, address: 0000000000000000
Dec 17 11:29:36 archlin kernel: #PF: supervisor read access in kernel mode
Dec 17 11:29:36 archlin kernel: #PF: error_code(0x0000) - not-present page
Dec 17 11:29:36 archlin kernel: PGD 0 P4D 0 
Dec 17 11:29:36 archlin kernel: Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
Dec 17 11:29:36 archlin kernel: CPU: 8 UID: 0 PID: 231 Comm: kworker/8:2 Not tainted 6.12.4-arch1-1 #1 7c6e9657ff18c9ac01abfce09529b4cbe186f917
Dec 17 11:29:36 archlin kernel: Hardware name: ASUSTeK COMPUTER INC. MINIPC PN51-S1/PN51-S1, BIOS 0110 12/29/2021
Dec 17 11:29:36 archlin kernel: Workqueue: pm pm_runtime_work
Dec 17 11:29:36 archlin kernel: RIP: 0010:btusb_suspend+0x45/0x1f0 [btusb]
Dec 17 11:29:36 archlin kernel: Code: 81 e5 00 04 00 00 75 22 8b 83 f4 02 00 00 8d 50 01 89 93 f4 02 00 00 85 c0 0f 84 58 01 00 00 31 c0 5b 5d 41 5c e9 cb 19 fe >
Dec 17 11:29:36 archlin kernel: RSP: 0018:ffff9f140059bc90 EFLAGS: 00010206
Dec 17 11:29:36 archlin kernel: RAX: ffffffffc0ed2990 RBX: 0000000000000000 RCX: 0000000000000007
Dec 17 11:29:36 archlin kernel: RDX: 0000000000000002 RSI: 0000000000000402 RDI: ffff89304007c800
Dec 17 11:29:36 archlin kernel: RBP: 0000000000000400 R08: ffff893041486000 R09: ffff89304007f4b0
Dec 17 11:29:36 archlin kernel: R10: ffff893f0f737808 R11: 0000000000000003 R12: ffff89304007c800
Dec 17 11:29:36 archlin kernel: R13: 0000000000000402 R14: 0000000000000003 R15: ffff893042348000
Dec 17 11:29:36 archlin kernel: FS:  0000000000000000(0000) GS:ffff893f0f800000(0000) knlGS:0000000000000000
Dec 17 11:29:36 archlin kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Dec 17 11:29:36 archlin kernel: CR2: 0000000000000000 CR3: 000000037e022000 CR4: 0000000000350ef0
Dec 17 11:29:36 archlin kernel: Call Trace:
Dec 17 11:29:36 archlin kernel:  <TASK>
Dec 17 11:29:36 archlin kernel:  ? __die_body.cold+0x19/0x27
Dec 17 11:29:36 archlin kernel:  ? page_fault_oops+0x15a/0x2d0
Dec 17 11:29:36 archlin kernel:  ? srso_return_thunk+0x5/0x5f
Dec 17 11:29:36 archlin kernel:  ? __refill_stock+0x81/0x90
Dec 17 11:29:36 archlin kernel:  ? exc_page_fault+0x81/0x190
Dec 17 11:29:36 archlin kernel:  ? asm_exc_page_fault+0x26/0x30
Dec 17 11:29:36 archlin kernel:  ? __pfx_btusb_suspend+0x10/0x10 [btusb 1446fd9caf9f47b72f6da29e6f7bdc579bac478b]
Dec 17 11:29:36 archlin kernel:  ? btusb_suspend+0x45/0x1f0 [btusb 1446fd9caf9f47b72f6da29e6f7bdc579bac478b]
Dec 17 11:29:36 archlin kernel:  usb_suspend_both+0xad/0x250
Dec 17 11:29:36 archlin kernel:  usb_runtime_suspend+0x2e/0x70
Dec 17 11:29:36 archlin kernel:  ? __pfx_usb_runtime_suspend+0x10/0x10
Dec 17 11:29:36 archlin kernel:  __rpm_callback+0x44/0x170
Dec 17 11:29:36 archlin kernel:  ? __pfx_usb_runtime_suspend+0x10/0x10
Dec 17 11:29:36 archlin kernel:  rpm_callback+0x55/0x60
Dec 17 11:29:36 archlin kernel:  ? __pfx_usb_runtime_suspend+0x10/0x10
Dec 17 11:29:36 archlin kernel:  rpm_suspend+0xe6/0x5f0
Dec 17 11:29:36 archlin kernel:  ? srso_return_thunk+0x5/0x5f
Dec 17 11:29:36 archlin kernel:  ? srso_return_thunk+0x5/0x5f
Dec 17 11:29:36 archlin kernel:  ? finish_task_switch.isra.0+0x99/0x2e0
Dec 17 11:29:36 archlin kernel:  ? __pfx_usb_runtime_idle+0x10/0x10
Dec 17 11:29:36 archlin kernel:  __pm_runtime_suspend+0x3a/0xc0
Dec 17 11:29:36 archlin kernel:  usb_runtime_idle+0x35/0x40
Dec 17 11:29:36 archlin kernel:  rpm_idle+0xc0/0x290
Dec 17 11:29:36 archlin kernel:  pm_runtime_work+0x84/0xb0
Dec 17 11:29:36 archlin kernel:  process_one_work+0x17e/0x330
Dec 17 11:29:36 archlin kernel:  worker_thread+0x2ce/0x3f0
Dec 17 11:29:36 archlin kernel:  ? __pfx_worker_thread+0x10/0x10
Dec 17 11:29:36 archlin kernel:  kthread+0xd2/0x100
Dec 17 11:29:36 archlin kernel:  ? __pfx_kthread+0x10/0x10
Dec 17 11:29:36 archlin kernel:  ret_from_fork+0x34/0x50
Dec 17 11:29:36 archlin kernel:  ? __pfx_kthread+0x10/0x10
Dec 17 11:29:36 archlin kernel:  ret_from_fork_asm+0x1a/0x30
Dec 17 11:29:36 archlin kernel:  </TASK>
Dec 17 11:29:36 archlin kernel: Modules linked in: snd_seq_dummy snd_hrtimer snd_seq snd_seq_device nft_masq nft_ct nft_reject_ipv4 nf_reject_ipv4 nft_reject act>
Dec 17 11:29:36 archlin kernel:  btusb drm_ttm_helper eeepc_wmi snd_rpl_pci_acp6x sha1_ssse3 snd_hda_codec asus_wmi ttm btrtl snd_acp_pci mac80211 aesni_intel pl>
Dec 17 11:29:36 archlin kernel: CR2: 0000000000000000
Dec 17 11:29:36 archlin kernel: ---[ end trace 0000000000000000 ]---
Dec 17 11:29:36 archlin kernel: RIP: 0010:btusb_suspend+0x45/0x1f0 [btusb]

I have since removed `bluez` from this machine. (Similar journalctl back when I first upgraded to 6.12.1, with btusb error occuring after the boot completed and landed into SDDM.)

Meanwhile, on the Framework Laptop 13 with AMD Ryzen 5 7640U and `MEDIATEK Corp. MT7922 802.11ax PCI Express Wireless Network Adapter`, during a boot,

Dec 11 21:25:44 framework kernel: BUG: kernel NULL pointer dereference, address: 0000000000000000
Dec 11 21:25:44 framework kernel: #PF: supervisor read access in kernel mode
Dec 11 21:25:44 framework kernel: #PF: error_code(0x0000) - not-present page
Dec 11 21:25:44 framework kernel: PGD 0 P4D 0 
Dec 11 21:25:44 framework kernel: Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
Dec 11 21:25:44 framework kernel: CPU: 4 UID: 0 PID: 530 Comm: kworker/4:2 Not tainted 6.12.1-arch1-1 #1 33f4a68ee85c59cb5d6edb747af0349869779b24
Dec 11 21:25:44 framework kernel: Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP05, BIOS 03.05 03/29/2024
Dec 11 21:25:44 framework kernel: Workqueue: pm pm_runtime_work
Dec 11 21:25:44 framework kernel: RIP: 0010:btusb_suspend+0x45/0x1f0 [btusb]
Dec 11 21:25:44 framework kernel: Code: 81 e5 00 04 00 00 75 22 8b 83 f4 02 00 00 8d 50 01 89 93 f4 02 00 00 85 c0 0f 84 58 01 00 00 31 c0 5b 5d 41 5c e9 36 97 3>
Dec 11 21:25:44 framework kernel: RSP: 0018:ffffa5488191fc90 EFLAGS: 00010206
Dec 11 21:25:44 framework kernel: RAX: ffffffffc19aa990 RBX: 0000000000000000 RCX: 0000000000000007
Dec 11 21:25:44 framework kernel: RDX: 0000000000000002 RSI: 0000000000000402 RDI: ffff946180e1a000
Dec 11 21:25:44 framework kernel: RBP: 0000000000000400 R08: ffff946189ac5800 R09: ffff946180e1dcb0
Dec 11 21:25:44 framework kernel: R10: 0000000000000003 R11: 0000000000000003 R12: ffff946180e1a000
Dec 11 21:25:44 framework kernel: R13: 0000000000000402 R14: 0000000000000003 R15: ffff946189b5c280
Dec 11 21:25:44 framework kernel: FS:  0000000000000000(0000) GS:ffff94648fe00000(0000) knlGS:0000000000000000
Dec 11 21:25:44 framework kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Dec 11 21:25:44 framework kernel: CR2: 0000000000000000 CR3: 00000001ffc22000 CR4: 0000000000f50ef0
Dec 11 21:25:44 framework kernel: PKRU: 55555554
Dec 11 21:25:44 framework kernel: Call Trace:
Dec 11 21:25:44 framework kernel:  <TASK>
Dec 11 21:25:44 framework kernel:  ? __die_body.cold+0x19/0x27
Dec 11 21:25:44 framework kernel:  ? page_fault_oops+0x15a/0x2d0
Dec 11 21:25:44 framework kernel:  ? exc_page_fault+0x81/0x190
Dec 11 21:25:44 framework kernel:  ? asm_exc_page_fault+0x26/0x30
Dec 11 21:25:44 framework kernel:  ? __pfx_btusb_suspend+0x10/0x10 [btusb d2bf447e789a8646c9298f622610b23766f5baf9]
Dec 11 21:25:44 framework kernel:  ? btusb_suspend+0x45/0x1f0 [btusb d2bf447e789a8646c9298f622610b23766f5baf9]
Dec 11 21:25:44 framework kernel:  usb_suspend_both+0xaa/0x250
Dec 11 21:25:44 framework kernel:  usb_runtime_suspend+0x2e/0x70
Dec 11 21:25:44 framework kernel:  ? __pfx_usb_runtime_suspend+0x10/0x10
Dec 11 21:25:44 framework kernel:  __rpm_callback+0x41/0x170
Dec 11 21:25:44 framework kernel:  ? __pfx_usb_runtime_suspend+0x10/0x10
Dec 11 21:25:44 framework kernel:  rpm_callback+0x55/0x60
Dec 11 21:25:44 framework kernel:  ? __pfx_usb_runtime_suspend+0x10/0x10
Dec 11 21:25:44 framework kernel:  rpm_suspend+0xe6/0x5f0
Dec 11 21:25:44 framework kernel:  ? srso_alias_return_thunk+0x5/0xfbef5
Dec 11 21:25:44 framework kernel:  ? srso_alias_return_thunk+0x5/0xfbef5
Dec 11 21:25:44 framework kernel:  ? finish_task_switch.isra.0+0x99/0x2e0
Dec 11 21:25:44 framework kernel:  ? __pfx_usb_runtime_idle+0x10/0x10
Dec 11 21:25:44 framework kernel:  __pm_runtime_suspend+0x3a/0xc0
Dec 11 21:25:44 framework kernel:  usb_runtime_idle+0x35/0x40
Dec 11 21:25:44 framework kernel:  rpm_idle+0xbd/0x290
Dec 11 21:25:44 framework kernel:  pm_runtime_work+0x84/0xb0
Dec 11 21:25:44 framework kernel:  process_one_work+0x17b/0x330
Dec 11 21:25:44 framework kernel:  worker_thread+0x2ce/0x3f0
Dec 11 21:25:44 framework kernel:  ? __pfx_worker_thread+0x10/0x10
Dec 11 21:25:44 framework kernel:  kthread+0xcf/0x100
Dec 11 21:25:44 framework kernel:  ? __pfx_kthread+0x10/0x10
Dec 11 21:25:44 framework kernel:  ret_from_fork+0x31/0x50
Dec 11 21:25:44 framework kernel:  ? __pfx_kthread+0x10/0x10
Dec 11 21:25:44 framework kernel:  ret_from_fork_asm+0x1a/0x30
Dec 11 21:25:44 framework kernel:  </TASK>
Dec 11 21:25:44 framework kernel: Modules linked in: tun nf_tables ip6table_nat ip6table_filter ip6_tables iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defr>
Dec 11 21:25:44 framework kernel:  cros_usbpd_logger cros_ec_hwmon cros_ec_sysfs gpio_cros_ec cros_ec_debugfs cros_usbpd_notify snd_hda_core snd_pci_acp6x videob>
Dec 11 21:25:44 framework kernel:  gf128mul drm_display_helper crypto_simd nvme_core cryptd cec i8042 ccp video crc16 nvme_auth serio wmi
Dec 11 21:25:44 framework kernel: CR2: 0000000000000000
Dec 11 21:25:44 framework kernel: ---[ end trace 0000000000000000 ]---
Dec 11 21:25:44 framework kernel: RIP: 0010:btusb_suspend+0x45/0x1f0 [btusb]

Last edited by tsukimomo (2025-02-19 07:16:59)

V1del · 2024-12-17 11:53:59

Currently not in an environment to build a kernel with said patch included (though in september that should likely be present already?), but these magic words are likely to summon loqs or gromit

Edit: On checking with upstream, that commit is in 6.13rc, so something you could test immediately is the linux-mainline branch: https://aur.archlinux.org/packages/linux-mainline (read the first comment for a repo, if you don't want to compile)

FWIW mediatek BT issues are somewhat known and common since the 6.11 kernel, can you check whether you can reproduce on LTS?

Last edited by V1del (2024-12-17 11:57:55)

loqs · 2024-12-17 12:01:21

Or use gromit's build:

sudo pacman -U https://pkgbuild.com//\~gromit/linux-bisection-kernels/linux-mainline-6.13rc3-1-x86_64.pkg.tar.zst

If that does not fix the issue then https://lore.kernel.org/all/20240822052 … iatek.com/

tsukimomo · 2024-12-17 15:46:50

V1del wrote:

Currently not in an environment to build a kernel with said patch included (though in september that should likely be present already?), but these magic words are likely to summon loqs or gromit
Edit: On checking with upstream, that commit is in 6.13rc, so something you could test immediately is the linux-mainline branch: https://aur.archlinux.org/packages/linux-mainline (read the first comment for a repo, if you don't want to compile)
FWIW mediatek BT issues are somewhat known and common since the 6.11 kernel, can you check whether you can reproduce on LTS?

For the few times I did boot into LTS kernel, it was without issue,
I just don't boot into LTS on the Framework due to power consumption reasons.
Looking forward to 6.13!

loqs wrote:

Or use gromit's build:
sudo pacman -U https://pkgbuild.com//\~gromit/linux-bisection-kernels/linux-mainline-6.13rc3-1-x86_64.pkg.tar.zst
If that does not fix the issue then https://lore.kernel.org/all/20240822052 … iatek.com/

I'll just wait for 6.13. Thanks for the suggestion still!

loqs · 2024-12-17 18:07:25

tsukimomo wrote:

loqs wrote:
Or use gromit's build:
sudo pacman -U https://pkgbuild.com//\~gromit/linux-bisection-kernels/linux-mainline-6.13rc3-1-x86_64.pkg.tar.zst
If that does not fix the issue then https://lore.kernel.org/all/20240822052 … iatek.com/
I'll just wait for 6.13. Thanks for the suggestion still!

In case you change your mind here is 6.12.5-arch1-1 with https://lore.kernel.org/all/20240822052 … iatek.com/ applied (which is not part of 6.13-rc3):
linux-6.12.5.arch1-1.2-x86_64.pkg.tar.zst/linux-headers-6.12.5.arch1-1.2-x86_64.pkg.tar.zst

tsukimomo · 2025-02-19 07:17:44

Been driving 6.13 kernel for a while already without btusb kernel module being blacklisted. Have not observed the same issue since.
Marking as solved.

Arch Linux

#1 2024-12-17 09:11:58

[Solved] 6.12 Kernel btusb NULL pointer dereference on AMD

#2 2024-12-17 11:53:59

Re: [Solved] 6.12 Kernel btusb NULL pointer dereference on AMD

#3 2024-12-17 12:01:21

Re: [Solved] 6.12 Kernel btusb NULL pointer dereference on AMD

#4 2024-12-17 15:46:50

Re: [Solved] 6.12 Kernel btusb NULL pointer dereference on AMD

#5 2024-12-17 18:07:25

Re: [Solved] 6.12 Kernel btusb NULL pointer dereference on AMD

#6 2025-02-19 07:17:44

Re: [Solved] 6.12 Kernel btusb NULL pointer dereference on AMD

Board footer