** Description changed:
- During Intel Bluetooth PCIe controller initialization, a GP1 mailbox
interrupt
- can occur before `data->hdev` has been initialized, resulting in a kernel
NULL
+ During Intel Bluetooth PCIe controller initialization, a GP1 mailbox interrupt
+ can occur before `data->hdev` has been initialized, resulting in a kernel NULL
pointer dereference.
+
+ The `btintel_pcie` driver initializes PCIe resources and registers/configures
+ MSI-X interrupt handlers before creating the HCI device. It then enables the
+ Bluetooth controller and waits for a GP0 interrupt that reports boot-stage
+ progress. The driver creates and registers the HCI device later through
+ `btintel_pcie_setup_hdev()`.
+
+ If a GP1 interrupt occurs before `data->hdev` is initialized,
+ `btintel_pcie_msix_gp1_handler()` calls
+ `btintel_pcie_dump_debug_registers(data->hdev)`. The debug-dump helper passes
+ the NULL `hdev` to `hci_get_drvdata()`, causing a kernel NULL pointer
+ dereference.
+
+ The reason for the early GP1 interrupt is unknown. GP1 is associated with
+ controller mailbox notifications and may reflect a firmware initialization
+ event or an unexpected controller condition.
** Tags added: jira-somerville-5677 oem-priority
** Also affects: linux (Ubuntu Resolute)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2170647
Title:
btintel_pcie crash due to null point.
To manage notifications about this bug go to:
https://bugs.launchpad.net/oem-priority/+bug/2170647/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
