General protection fault in Bluetooth HID (Magic Mouse driver)

[Andrew Novikov]

Description: KDE neon User Edition 5.21
Release: 20.04

linux-image-5.10.0-1014-oem:
  Installed: 5.10.0-1014.15
  Candidate: 5.10.0-1014.15

Once in a while (typically once every 10 minutes or so) my Bluetooth Apple Magic Mouse (I gen) disconnects and reconnects again leading to the "magicmouse 0005:05AC:030D.001E: unknown main item tag 0x0" messages in the kernel log. But this time it seems to have caused a crash in the Bluetooth stack. Here is the dmesg output:

[57748.295271] magicmouse 0005:05AC:030D.001E: unknown main item tag 0x0
[57748.295749] input: Magic Mouse as /devices/pci0000:00/0000:00:14.0/usb1/1-14/1-14:1.0/bluetooth/hci0/hci0:512/0005:05AC:030D.001E/input/input56
[57748.296035] magicmouse 0005:05AC:030D.001E: input,hidraw1: BLUETOOTH HID v3.06 Mouse [Magic Mouse] on 34:2e:b7:45:c7:ba

[62464.630828] general protection fault, probably for non-canonical address 0xdead0000000000e8: 0000 [#1] SMP NOPTI
[62464.630835] CPU: 11 PID: 36176 Comm: kworker/u25:2 Tainted: G O 5.10.0-1014-oem #15-Ubuntu
[62464.630836] Hardware name: Dell Inc. Precision 5750/0XFTD8, BIOS 1.6.3 12/30/2020
[62464.630860] Workqueue: hci0 hci_rx_work [bluetooth]
[62464.630867] RIP: 0010:__wake_up_common+0xbd/0x140
[62464.630869] Code: c0 00 74 26 41 83 c4 01 41 83 fc 40 7e 1c 48 8d 43 18 48 39 45 d0 75 66 8b 45 c8 48 83 c4 18 5b 41 5c 41 5d 41 5e 41 5f 5d c3 <48> 8b 43 18 48 89 df 48 8d 53 18 48 83 e8 18 48 39 55 d0 74 d9 48
[62464.630871] RSP: 0018:ffffa0b58be0fb80 EFLAGS: 00010083
[62464.630873] RAX: 0000000000000000 RBX: dead0000000000e8 RCX: ffffffffc1672078
[62464.630875] RDX: 0000000000000001 RSI: 0000000000000046 RDI: 0000000000000046
[62464.630876] RBP: ffffa0b58be0fbc0 R08: 0000000000000000 R09: ffffa0b58be0faf8
[62464.630878] R10: ffff94fe130d5a10 R11: ffff95057d56c270 R12: 0000000000000002
[62464.630879] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[62464.630881] FS: 0000000000000000(0000) GS:ffff95057d6c0000(0000) knlGS:0000000000000000
[62464.630883] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[62464.630884] CR2: 0000119361d2e000 CR3: 00000001b2bce004 CR4: 00000000007706e0
[62464.630886] PKRU: 55555554
[62464.630887] Call Trace:
[62464.630892] __wake_up_common_lock+0x7c/0xc0
[62464.630896] __wake_up+0x13/0x20
[62464.630898] sock_def_wakeup+0x36/0x40
[62464.630919] l2cap_sock_teardown_cb+0x1b1/0x200 [bluetooth]
[62464.630936] l2cap_chan_del+0x4a/0x2e0 [bluetooth]
[62464.630952] l2cap_conn_del+0x113/0x230 [bluetooth]
[62464.630969] l2cap_disconn_cfm+0x3d/0x60 [bluetooth]
[62464.630983] hci_disconn_complete_evt.isra.0+0x147/0x2e0 [bluetooth]
[62464.630998] hci_event_packet+0x1b43/0x29b0 [bluetooth]
[62464.631010] hci_rx_work+0x1a5/0x3b0 [bluetooth]
[62464.631013] process_one_work+0x1ef/0x390
[62464.631016] worker_thread+0x4d/0x3f0
[62464.631018] kthread+0x114/0x150
[62464.631020] ? process_one_work+0x390/0x390
[62464.631022] ? kthread_park+0x90/0x90
[62464.631025] ret_from_fork+0x1f/0x30
[62464.631027] Modules linked in: hid_magicmouse hidp rfcomm vboxnetadp(O) vboxnetflt(O) vboxdrv(O) ccm aufs cmac algif_hash algif_skcipher overlay af_alg bnep zram btusb btrtl btbcm btintel bluetooth nls_iso8859_1 ecdh_generic ecc uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev mc snd_soc_sof_sdw snd_soc_hdac_hdmi snd_soc_rt715 snd_soc_rt1308_sdw snd_soc_rt711 regmap_sdw snd_soc_dmic snd_sof_pci snd_sof_intel_byt mei_hdcp intel_rapl_msr snd_sof_intel_ipc snd_sof_intel_hda_common snd_soc_hdac_hda dell_rbtn snd_sof_xtensa_dsp snd_sof_intel_hda snd_sof snd_hda_codec_hdmi dell_laptop snd_hda_ext_core snd_soc_acpi_intel_match dell_smm_hwmon snd_soc_acpi ledtrig_audio snd_hda_intel joydev snd_intel_dspcfg soundwire_intel x86_pkg_temp_thermal intel_powerclamp soundwire_generic_allocation soundwire_cadence snd_seq_midi coretemp snd_seq_midi_event snd_hda_codec snd_rawmidi snd_hda_core kvm_intel snd_hwdep soundwire_bus snd_soc_core iwlmvm kvm snd_compress ac97_bus
[62464.631086] dell_wmi snd_pcm_dmaengine dell_smbios mac80211 snd_seq rapl snd_pcm dcdbas libarc4 intel_cstate input_leds serio_raw efi_pstore dell_wmi_descriptor snd_seq_device wmi_bmof hid_sensor_gyro_3d intel_wmi_thunderbolt iwlwifi ee1004 snd_timer hid_sensor_als hid_sensor_trigger industrialio_triggered_buffer kfifo_buf hid_sensor_iio_common industrialio snd ucsi_ccg mei_me processor_thermal_device ucsi_acpi cfg80211 cros_ec_ishtp typec_ucsi intel_rapl_common mei hid_multitouch cros_ec soundcore intel_soc_dts_iosf intel_pch_thermal typec int3403_thermal int340x_thermal_zone mac_hid intel_hid int3400_thermal acpi_tad sparse_keymap acpi_pad acpi_thermal_rel sch_fq_codel msr parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs blake2b_generic raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear hid_sensor_custom hid_sensor_hub intel_ishtp_loader intel_ishtp_hid hid_generic rtsx_pci_sdmmc i915 crct10dif_pclmul
[62464.631156] crc32_pclmul ghash_clmulni_intel aesni_intel i2c_algo_bit drm_kms_helper crypto_simd cryptd glue_helper syscopyarea sysfillrect sysimgblt fb_sys_fops psmouse cec i2c_i801 rc_core i2c_smbus drm nvme thunderbolt intel_lpss_pci intel_lpss rtsx_pci nvme_core intel_ish_ipc idma64 xhci_pci virt_dma intel_ishtp xhci_pci_renesas i2c_nvidia_gpu i2c_hid wmi hid video pinctrl_cannonlake
[62464.631191] ---[ end trace cfcccbd2fd94c043 ]---

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.