[Bug 2166569] Re: btmtk: NULL pointer dereference in usb_autopm_get_interface during btmtk_setup_firmware_79xx on 6.8.0-139-generic (MT7961)

*** This bug is a duplicate of bug 2165873 *** https://bugs.launchpad.net/bugs/2165873 ** Also affects: linux-lowlatency (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2166569 Title: btmtk: NULL pointer dereference in usb_autopm_get_interface during btmtk_setup_firmware_79xx on 6.8.0-139-generic (MT7961) Status in linux package in Ubuntu: Confirmed Status in linux-lowlatency package in Ubuntu: Confirmed Bug description: After upgrading to linux-image-6.8.0-139-generic on Ubuntu 24.04 LTS, Bluetooth stopped working entirely. The btmtk driver hits a NULL pointer dereference while setting up the MT7961 controller firmware, which kills the hci_power_on kworker. As a result hci0 is registered (visible in rfkill) but never initialized, and bluetoothctl reports "No default controller available". Booting 6.8.0-138-generic makes Bluetooth work again, so this is a regression introduced in 6.8.0-139. Hardware: Acer Aspire A515-57 (Ganymede_ADU), BIOS V1.26 01/23/2024 Bluetooth device: USB 04ca:3802 Lite-On Wireless_Device (MediaTek MT7961, combo with mt7921e Wi-Fi) Wi-Fi side (mt7921e) loads fine on both kernels; only Bluetooth is affected. linux-firmware 20240318.git3b128b60.0ubuntu3.1, BT_RAM_CODE_MT7961_* present in /lib/firmware/mediatek/ Steps to reproduce: 1. Boot 6.8.0-139-generic 2. bluetoothctl show Expected: controller is listed. Actual: "No default controller available", and dmesg shows the Oops below. Kernel Oops from 6.8.0-139-generic: [ 3.400181] Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20240219111427 [ 3.400191] BUG: kernel NULL pointer dereference, address: 0000000000000219 [ 3.400195] #PF: supervisor read access in kernel mode [ 3.400196] #PF: error_code(0x0000) - not-present page [ 3.400201] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 3.400204] CPU: 6 PID: 139 Comm: kworker/u25:0 Not tainted 6.8.0-139-generic #139-Ubuntu [ 3.400206] Hardware name: Acer Aspire A515-57/Ganymede_ADU, BIOS V1.26 01/23/2024 [ 3.400208] Workqueue: hci0 hci_power_on [bluetooth] [ 3.400257] RIP: 0010:__pm_runtime_resume+0x1b/0x80 [ 3.400265] RSP: 0018:ffffcced006efb30 EFLAGS: 00010246 [ 3.400267] RAX: ffff89480b5254d0 RBX: 0000000000000050 RCX: 0000000000000000 [ 3.400268] RDX: 0000000000000035 RSI: 0000000000000000 RDI: 0000000000000050 [ 3.400276] CR2: 0000000000000219 CR3: 000000064a63c001 CR4: 0000000000f70ef0 [ 3.400279] Call Trace: [ 3.400281] <TASK> [ 3.400284] usb_autopm_get_interface+0x1d/0x60 [ 3.400290] btmtk_usb_hci_wmt_sync+0xa9/0x2e0 [btmtk] [ 3.400295] btmtk_setup_firmware_79xx+0x1c7/0x360 [btmtk] [ 3.400298] btusb_mtk_setup+0x453/0x610 [btusb] [ 3.400302] hci_dev_setup_sync+0x6c/0x430 [bluetooth] [ 3.400346] hci_dev_init_sync+0x3e/0x1c0 [bluetooth] [ 3.400381] hci_dev_open_sync+0xb1/0x350 [bluetooth] [ 3.400414] hci_dev_do_open+0x28/0x70 [bluetooth] [ 3.400440] hci_power_on+0x50/0x210 [bluetooth] [ 3.400470] process_one_work+0x181/0x3a0 [ 3.400474] worker_thread+0x18b/0x330 [ 3.400479] kthread+0xef/0x120 [ 3.400482] ret_from_fork+0x44/0x70 [ 3.400487] ret_from_fork_asm+0x1b/0x30 [ 3.400490] </TASK> Note: this report was filed while running 6.8.0-138-generic (the working kernel), so the automatically collected data reflects -138, not the affected -139. ProblemType: Bug DistroRelease: Ubuntu 24.04 Package: linux-image-6.8.0-138-generic 6.8.0-138.138 ProcVersionSignature: Ubuntu 6.8.0-138.138-generic 6.8.12 Uname: Linux 6.8.0-138-generic x86_64 ApportVersion: 2.28.3-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: bruno 2629 F.... wireplumber /dev/snd/seq: bruno 2627 F.... pipewire CRDA: N/A CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME Date: Sat Sep 5 07:40:39 2026 MachineType: Acer Aspire A515-57 ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.8.0-138-generic root=UUID=bddae004-6880-4401-99e0-54b9652f9570 ro quiet splash vt.handoff=7 PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No PulseAudio daemon running, or not running as session daemon. RelatedPackageVersions: linux-restricted-modules-6.8.0-138-generic N/A linux-backports-modules-6.8.0-138-generic N/A linux-firmware 20240318.git3b128b60.0ubuntu3.1 SourcePackage: linux UpgradeStatus: Upgraded to noble on 2025-12-28 (250 days ago) dmi.bios.date: 01/23/2024 dmi.bios.release: 1.26 dmi.bios.vendor: Insyde Corp. dmi.bios.version: V1.26 dmi.board.asset.tag: Type2 - Board Asset Tag dmi.board.name: Ganymede_ADU dmi.board.vendor: ADL dmi.board.version: V1.26 dmi.chassis.type: 10 dmi.chassis.vendor: Acer dmi.chassis.version: V1.26 dmi.ec.firmware.release: 1.26 dmi.modalias: dmi:bvnInsydeCorp.:bvrV1.26:bd01/23/2024:br1.26:efr1.26:svnAcer:pnAspireA515-57:pvrV1.26:rvnADL:rnGanymede_ADU:rvrV1.26:cvnAcer:ct10:cvrV1.26:sku0000000000000000: dmi.product.family: Aspire 5 dmi.product.name: Aspire A515-57 dmi.product.sku: 0000000000000000 dmi.product.version: V1.26 dmi.sys.vendor: Acer To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2166569/+subscriptions