Public bug reported:
During Intel Bluetooth PCIe controller initialization, a GP1 mailbox interrupt
can occur before `data->hdev` has been initialized, resulting in a kernel NULL
pointer dereference.
The `btintel_pcie` driver initializes PCIe resources and registers/configures
MSI-X interrupt handlers before creating the HCI device. It then enables the
Bluetooth controller and waits for a GP0 interrupt that reports boot-stage
progress. The driver creates and registers the HCI device later through
`btintel_pcie_setup_hdev()`.
If a GP1 interrupt occurs before `data->hdev` is initialized,
`btintel_pcie_msix_gp1_handler()` calls
`btintel_pcie_dump_debug_registers(data->hdev)`. The debug-dump helper passes
the NULL `hdev` to `hci_get_drvdata()`, causing a kernel NULL pointer
dereference.
The reason for the early GP1 interrupt is unknown. GP1 is associated with
controller mailbox notifications and may reflect a firmware initialization
event or an unexpected controller condition.
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2170647
Title:
btintel_pcie crash due to null point.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2170647/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
