Public bug reported: SUMMARY On kernel 6.8.0-139-generic, the Bluetooth controller on a MediaTek MT7922 Wi-Fi/Bluetooth combo adapter fails to initialize. The kernel throws a NULL pointer dereference during firmware setup, hci0 never comes up, and `bluetoothctl` reports "No default controller available" even though rfkill shows the device as present and unblocked. Booting the previous point release, 6.8.0-138-generic, with no other changes, fixes the issue completely — Bluetooth initializes normally and the controller powers on. HARDWARE - Adapter: MediaTek MT7922 802.11ax PCIe Wi-Fi + Bluetooth combo (lspci: "04:00.0 Network controller: MEDIATEK Corp. MT7922 802.11ax PCI Express Wireless Network Adapter", driver mt7921e) - Bluetooth HCI: hci0, driver btusb/btmtk - Laptop: Framework 15 AFFECTED / WORKING KERNELS - Broken: 6.8.0-139-generic (6.8.0-139.139) - Working: 6.8.0-138-generic (6.8.0-138.138) STEPS TO REPRODUCE 1. Boot 6.8.0-139-generic 2. Run `rfkill list` — hci0 shows present, not soft/hard blocked 3. Run `systemctl status bluetooth` — service is active/running 4. Run `bluetoothctl show` — reports "No default controller available" 5. Attempt to enable Bluetooth from GNOME Settings — toggle does not turn on / has no effect 6. Check `sudo dmesg | grep -A30 btmtk_setup_firmware_79xx` — shows a kernel oops with a NULL pointer dereference (see trace below) EXPECTED BEHAVIOR Bluetooth controller initializes normally and can be enabled from Settings, as it does on 6.8.0-138-generic. ACTUAL BEHAVIOR Kernel oops during hci_power_on -> btmtk firmware setup, controller never registers with BlueZ. KERNEL OOPS (6.8.0-139-generic) [ 4.747120] Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20250523103438 [ 4.747142] Workqueue: hci0 hci_power_on [bluetooth] [ 4.747201] btmtk_usb_hci_wmt_sync+0xa9/0x2e0 [btmtk] [ 4.747204] ? __pfx_btmtk_usb_hci_wmt_sync+0x10/0x10 [btmtk] [ 4.747207] btmtk_setup_firmware_79xx+0x1c7/0x360 [btmtk] [ 4.747212] btusb_mtk_setup+0x453/0x610 [btusb] [ 4.747218] hci_dev_setup_sync+0x6c/0x430 [bluetooth] [ 4.747241] ? __pm_runtime_idle+0x4c/0xd0 [ 4.747244] hci_dev_init_sync+0x3e/0x1c0 [bluetooth] [ 4.747278] hci_dev_open_sync+0xb1/0x350 [bluetooth] [ 4.747318] hci_dev_do_open+0x28/0x70 [bluetooth] [ 4.747352] hci_power_on+0x50/0x210 [bluetooth] [ 4.747398] process_one_work+0x181/0x3a0 [ 4.747404] worker_thread+0x18b/0x330 [ 4.747412] kthread+0xef/0x120 [ 4.747420] ret_from_fork+0x44/0x70 [ 4.747428] ret_from_fork_asm+0x1b/0x30 [ 4.747435] </TASK> [ 4.747574] CR2: 0000000000000219 [ 4.747578] ---[ end trace 0000000000000000 ]--- [ 5.002337] mt7921e 0000:04:00.0: HW/SW Version: 0x8a108a10, Build Time: 20250523103150a [ 5.109748] mt7921e 0000:04:00.0: WM Firmware Version: ____000000, Build Time: 20250523103234 Note CR2 = 0x219, a small offset from NULL — consistent with a NULL struct pointer being dereferenced with a field offset inside btmtk_setup_firmware_79xx / btmtk_usb_hci_wmt_sync. Also note the Bluetooth and Wi-Fi halves of the chip both print firmware version info at boot; the Wi-Fi half (mt7921e) succeeds while the Bluetooth half (btmtk) crashes. This may point to a race or shared resource issue between the two drivers on this combo chip. ADDITIONAL SYMPTOM While investigating, running `sudo modprobe -r btusb` on the affected kernel (6.8.0-139-generic) hung indefinitely in an uninterruptible state (did not respond to Ctrl+C), suggesting the driver may leave a lock or work item in a bad state after the initial oops. WORKAROUND Booting 6.8.0-138-generic instead of 6.8.0-139-generic resolves the issue with no other changes. Reinstalling linux-firmware and rebooting on 6.8.0-139-generic did NOT resolve it, suggesting this is a kernel/ driver regression rather than a firmware blob issue. ADDITIONAL INFO $ lspci -k | grep -A3 -i network 04:00.0 Network controller: MEDIATEK Corp. MT7922 802.11ax PCI Express Wireless Network Adapter Subsystem: MEDIATEK Corp. MT7922 802.11ax PCI Express Wireless Network Adapter Kernel driver in use: mt7921e Kernel modules: mt7921e $ rfkill list 0: hci0: Bluetooth Soft blocked: no Hard blocked: no 1: phy0: Wireless LAN Soft blocked: no Hard blocked: no ProblemType: Bug DistroRelease: Ubuntu 24.04 Package: linux-image-6.8.0-138-generic 6.8.0-138.138 ProcVersionSignature: Ubuntu 6.8.0-138.138-generic 6.8.12 Uname: Linux 6.8.0-138-generic x86_64 ApportVersion: 2.28.1-0ubuntu3.8 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC2: plaba 4379 F.... wireplumber /dev/snd/controlC0: plaba 4379 F.... wireplumber /dev/snd/controlC1: plaba 4379 F.... wireplumber /dev/snd/seq: plaba 4375 F.... pipewire CRDA: N/A CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME Date: Fri Sep 11 22:37:14 2026 InstallationDate: Installed on 2021-12-11 (1736 days ago) InstallationMedia: Ubuntu 20.04.3 LTS "Focal Fossa" - Release amd64 (20210819) MachineType: Framework Laptop 16 (AMD Ryzen 7040 Series) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 amdgpudrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.8.0-138-generic root=UUID=0cd2207b-af42-4735-8148-fa96decb31f3 ro security=selinux quiet splash intel_iommu=off crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M vt.handoff=7 PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No PulseAudio daemon running, or not running as session daemon. RelatedPackageVersions: linux-restricted-modules-6.8.0-138-generic N/A linux-backports-modules-6.8.0-138-generic N/A linux-firmware 20240318.git3b128b60.0ubuntu3.1 SourcePackage: linux UpgradeStatus: Upgraded to noble on 2026-02-21 (202 days ago) dmi.bios.date: 12/22/2025 dmi.bios.release: 4.3 dmi.bios.vendor: INSYDE Corp. dmi.bios.version: 04.03 dmi.board.asset.tag: * dmi.board.name: FRANMZCP07 dmi.board.vendor: Framework dmi.board.version: A7 dmi.chassis.asset.tag: FRAGACCPA744840005 dmi.chassis.type: 10 dmi.chassis.vendor: Framework dmi.chassis.version: A7 dmi.modalias: dmi:bvnINSYDECorp.:bvr04.03:bd12/22/2025:br4.3:svnFramework:pnLaptop16(AMDRyzen7040Series):pvrA7:rvnFramework:rnFRANMZCP07:rvrA7:cvnFramework:ct10:cvrA7:skuFRAGACCP07: dmi.product.family: 16in Laptop dmi.product.name: Laptop 16 (AMD Ryzen 7040 Series) dmi.product.sku: FRAGACCP07 dmi.product.version: A7 dmi.sys.vendor: Framework modified.conffile..etc.apport.crashdb.conf: [modified] mtime.conffile..etc.apport.crashdb.conf: 2023-04-23T16:21:23.712186 ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Tags: amd64 apport-bug noble third-party-packages -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2167148 Title: Bluetooth (MediaTek MT7922) fails to initialize with NULL pointer dereference in btmtk_setup_firmware_79xx on 6.8.0-139-generic; works on 6.8.0-138-generic Status in linux package in Ubuntu: New Bug description: SUMMARY On kernel 6.8.0-139-generic, the Bluetooth controller on a MediaTek MT7922 Wi-Fi/Bluetooth combo adapter fails to initialize. The kernel throws a NULL pointer dereference during firmware setup, hci0 never comes up, and `bluetoothctl` reports "No default controller available" even though rfkill shows the device as present and unblocked. Booting the previous point release, 6.8.0-138-generic, with no other changes, fixes the issue completely — Bluetooth initializes normally and the controller powers on. HARDWARE - Adapter: MediaTek MT7922 802.11ax PCIe Wi-Fi + Bluetooth combo (lspci: "04:00.0 Network controller: MEDIATEK Corp. MT7922 802.11ax PCI Express Wireless Network Adapter", driver mt7921e) - Bluetooth HCI: hci0, driver btusb/btmtk - Laptop: Framework 15 AFFECTED / WORKING KERNELS - Broken: 6.8.0-139-generic (6.8.0-139.139) - Working: 6.8.0-138-generic (6.8.0-138.138) STEPS TO REPRODUCE 1. Boot 6.8.0-139-generic 2. Run `rfkill list` — hci0 shows present, not soft/hard blocked 3. Run `systemctl status bluetooth` — service is active/running 4. Run `bluetoothctl show` — reports "No default controller available" 5. Attempt to enable Bluetooth from GNOME Settings — toggle does not turn on / has no effect 6. Check `sudo dmesg | grep -A30 btmtk_setup_firmware_79xx` — shows a kernel oops with a NULL pointer dereference (see trace below) EXPECTED BEHAVIOR Bluetooth controller initializes normally and can be enabled from Settings, as it does on 6.8.0-138-generic. ACTUAL BEHAVIOR Kernel oops during hci_power_on -> btmtk firmware setup, controller never registers with BlueZ. KERNEL OOPS (6.8.0-139-generic) [ 4.747120] Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20250523103438 [ 4.747142] Workqueue: hci0 hci_power_on [bluetooth] [ 4.747201] btmtk_usb_hci_wmt_sync+0xa9/0x2e0 [btmtk] [ 4.747204] ? __pfx_btmtk_usb_hci_wmt_sync+0x10/0x10 [btmtk] [ 4.747207] btmtk_setup_firmware_79xx+0x1c7/0x360 [btmtk] [ 4.747212] btusb_mtk_setup+0x453/0x610 [btusb] [ 4.747218] hci_dev_setup_sync+0x6c/0x430 [bluetooth] [ 4.747241] ? __pm_runtime_idle+0x4c/0xd0 [ 4.747244] hci_dev_init_sync+0x3e/0x1c0 [bluetooth] [ 4.747278] hci_dev_open_sync+0xb1/0x350 [bluetooth] [ 4.747318] hci_dev_do_open+0x28/0x70 [bluetooth] [ 4.747352] hci_power_on+0x50/0x210 [bluetooth] [ 4.747398] process_one_work+0x181/0x3a0 [ 4.747404] worker_thread+0x18b/0x330 [ 4.747412] kthread+0xef/0x120 [ 4.747420] ret_from_fork+0x44/0x70 [ 4.747428] ret_from_fork_asm+0x1b/0x30 [ 4.747435] </TASK> [ 4.747574] CR2: 0000000000000219 [ 4.747578] ---[ end trace 0000000000000000 ]--- [ 5.002337] mt7921e 0000:04:00.0: HW/SW Version: 0x8a108a10, Build Time: 20250523103150a [ 5.109748] mt7921e 0000:04:00.0: WM Firmware Version: ____000000, Build Time: 20250523103234 Note CR2 = 0x219, a small offset from NULL — consistent with a NULL struct pointer being dereferenced with a field offset inside btmtk_setup_firmware_79xx / btmtk_usb_hci_wmt_sync. Also note the Bluetooth and Wi-Fi halves of the chip both print firmware version info at boot; the Wi-Fi half (mt7921e) succeeds while the Bluetooth half (btmtk) crashes. This may point to a race or shared resource issue between the two drivers on this combo chip. ADDITIONAL SYMPTOM While investigating, running `sudo modprobe -r btusb` on the affected kernel (6.8.0-139-generic) hung indefinitely in an uninterruptible state (did not respond to Ctrl+C), suggesting the driver may leave a lock or work item in a bad state after the initial oops. WORKAROUND Booting 6.8.0-138-generic instead of 6.8.0-139-generic resolves the issue with no other changes. Reinstalling linux-firmware and rebooting on 6.8.0-139-generic did NOT resolve it, suggesting this is a kernel/ driver regression rather than a firmware blob issue. ADDITIONAL INFO $ lspci -k | grep -A3 -i network 04:00.0 Network controller: MEDIATEK Corp. MT7922 802.11ax PCI Express Wireless Network Adapter Subsystem: MEDIATEK Corp. MT7922 802.11ax PCI Express Wireless Network Adapter Kernel driver in use: mt7921e Kernel modules: mt7921e $ rfkill list 0: hci0: Bluetooth Soft blocked: no Hard blocked: no 1: phy0: Wireless LAN Soft blocked: no Hard blocked: no ProblemType: Bug DistroRelease: Ubuntu 24.04 Package: linux-image-6.8.0-138-generic 6.8.0-138.138 ProcVersionSignature: Ubuntu 6.8.0-138.138-generic 6.8.12 Uname: Linux 6.8.0-138-generic x86_64 ApportVersion: 2.28.1-0ubuntu3.8 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC2: plaba 4379 F.... wireplumber /dev/snd/controlC0: plaba 4379 F.... wireplumber /dev/snd/controlC1: plaba 4379 F.... wireplumber /dev/snd/seq: plaba 4375 F.... pipewire CRDA: N/A CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME Date: Fri Sep 11 22:37:14 2026 InstallationDate: Installed on 2021-12-11 (1736 days ago) InstallationMedia: Ubuntu 20.04.3 LTS "Focal Fossa" - Release amd64 (20210819) MachineType: Framework Laptop 16 (AMD Ryzen 7040 Series) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 amdgpudrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.8.0-138-generic root=UUID=0cd2207b-af42-4735-8148-fa96decb31f3 ro security=selinux quiet splash intel_iommu=off crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M vt.handoff=7 PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No PulseAudio daemon running, or not running as session daemon. RelatedPackageVersions: linux-restricted-modules-6.8.0-138-generic N/A linux-backports-modules-6.8.0-138-generic N/A linux-firmware 20240318.git3b128b60.0ubuntu3.1 SourcePackage: linux UpgradeStatus: Upgraded to noble on 2026-02-21 (202 days ago) dmi.bios.date: 12/22/2025 dmi.bios.release: 4.3 dmi.bios.vendor: INSYDE Corp. dmi.bios.version: 04.03 dmi.board.asset.tag: * dmi.board.name: FRANMZCP07 dmi.board.vendor: Framework dmi.board.version: A7 dmi.chassis.asset.tag: FRAGACCPA744840005 dmi.chassis.type: 10 dmi.chassis.vendor: Framework dmi.chassis.version: A7 dmi.modalias: dmi:bvnINSYDECorp.:bvr04.03:bd12/22/2025:br4.3:svnFramework:pnLaptop16(AMDRyzen7040Series):pvrA7:rvnFramework:rnFRANMZCP07:rvrA7:cvnFramework:ct10:cvrA7:skuFRAGACCP07: dmi.product.family: 16in Laptop dmi.product.name: Laptop 16 (AMD Ryzen 7040 Series) dmi.product.sku: FRAGACCP07 dmi.product.version: A7 dmi.sys.vendor: Framework modified.conffile..etc.apport.crashdb.conf: [modified] mtime.conffile..etc.apport.crashdb.conf: 2023-04-23T16:21:23.712186 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2167148/+subscriptions
Комментариев нет:
Отправить комментарий