iwlwifi disconnect and crash - intel wifi7

[Jacek Kowalski]

iwlwifi disconnecting and crashing when I using Wifi 2.4GHz.

------------[ cut here ]------------
Invalid rxb from HW 0
WARNING: CPU: 14 PID: 896 at drivers/net/wireless/intel/iwlwifi/pcie/rx.c:1489 iwl_pcie_rx_handle+0x3ce/0x640 [iwlwifi]
Modules linked in: ccm vboxdrv(OE) rfcomm cmac algif_hash algif_skcipher af_alg bnep btusb btrtl btbcm btintel btmtk bluetooth ecdh_generic input_leds joydev ecc intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common nft_limit x86_pkg_temp_thermal intel_powerclamp coretemp iwlmvm kvm_intel xt_tcpudp xt_LOG nf_log_syslog kvm mac80211 xt_limit xt_conntrack nf_conntrack libarc4 nf_defrag_ipv6 irqbypass nf_defrag_ipv4 crct10dif_pclmul crc32_pclmul nft_compat polyval_clmulni polyval_generic nf_tables ghash_clmulni_intel libcrc32c sha256_ssse3 iwlwifi sha1_ssse3 sunrpc rapl nvidia_uvm(PO) nfnetlink binfmt_misc n
 xhci_pci xhci_pci_renesas nvme_common video wmi mac_hid
CPU: 14 PID: 896 Comm: irq/160-iwlwifi Tainted: P W OE 6.5.0-26-generic #26~22.04.1-Ubuntu
Hardware name: ASRock Z790 Nova WiFi/Z790 Nova WiFi, BIOS 3.09 12/26/2023
RIP: 0010:iwl_pcie_rx_handle+0x3ce/0x640 [iwlwifi]
Code: e9 8b 43 34 83 43 30 08 83 e8 08 89 43 34 e9 70 fe ff ff 44 89 f0 89 d6 45 89 e6 41 89 c4 48 c7 c7 a8 cb 53 c4 e8 42 e4 62 e8 <0f> 0b 4c 89 ff e8 e8 3b ff ff 8b 55 d4 85 d2 0f 95 c0 41 21 c6 e9
RSP: 0018:ffffb91d803e0e18 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff956747353c30 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffb91d803e0e78 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000001007
R13: 0000000000000015 R14: 0000000000000000 R15: ffff956746a30028
FS: 0000000000000000(0000) GS:ffff95768f380000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000002659c472000 CR3: 0000000112e8e000 CR4: 0000000000752ee0
PKRU: 55555554
Call Trace:
 <IRQ>
 ? show_regs+0x6d/0x80
 ? __warn+0x89/0x160
 ? iwl_pcie_rx_handle+0x3ce/0x640 [iwlwifi]
 ? report_bug+0x17e/0x1b0
 ? handle_bug+0x46/0x90
 ? exc_invalid_op+0x18/0x80
 ? asm_exc_invalid_op+0x1b/0x20
 ? iwl_pcie_rx_handle+0x3ce/0x640 [iwlwifi]
 ? iwl_pcie_rx_handle+0x3ce/0x640 [iwlwifi]
 ? free_unref_page+0x30/0x180
 iwl_pcie_napi_poll_msix+0x32/0x100 [iwlwifi]
 ? skb_free_head+0xa8/0xd0
 __napi_poll+0x30/0x1f0
 net_rx_action+0x181/0x2e0
 ? __irq_wake_thread+0x42/0x50
 __do_softirq+0xd9/0x349
 ? __pfx_irq_thread_fn+0x10/0x10
 do_softirq.part.0+0x41/0x80
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x72/0x80
 iwl_pcie_irq_rx_msix_handler+0xd7/0x1a0 [iwlwifi]
 irq_thread_fn+0x21/0x70
 irq_thread+0xf8/0x1c0
 ? __pfx_irq_thread_dtor+0x10/0x10
 ? __pfx_irq_thread+0x10/0x10
 kthread+0xef/0x120
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x44/0x70
 ? __pfx_kthread+0x10/0x10
 ret_from_fork_asm+0x1b/0x30
 </TASK>
---[ end trace 0000000000000000 ]---
iwlwifi 0000:05:00.0: Microcode SW error detected. Restarting 0x0.
iwlwifi 0000:05:00.0: Start IWL Error Log Dump:
iwlwifi 0000:05:00.0: Transport status: 0x0000004A, valid: 6
iwlwifi 0000:05:00.0: Loaded firmware version: 83.ec13314b.0 gl-c0-fm-c0-83.ucode
iwlwifi 0000:05:00.0: 0x00000084 | NMI_INTERRUPT_UNKNOWN
iwlwifi 0000:05:00.0: 0x00000003 | trm_hw_status0
iwlwifi 0000:05:00.0: 0x00000000 | trm_hw_status1
iwlwifi 0000:05:00.0: 0x002C280A | branchlink2
iwlwifi 0000:05:00.0: 0x00009328 | interruptlink1
iwlwifi 0000:05:00.0: 0x00009328 | interruptlink2
iwlwifi 0000:05:00.0: 0x0000F46C | data1
iwlwifi 0000:05:00.0: 0x01000000 | data2
iwlwifi 0000:05:00.0: 0x00000000 | data3
iwlwifi 0000:05:00.0: 0xA0005E44 | beacon time
iwlwifi 0000:05:00.0: 0x2806818F | tsf low
iwlwifi 0000:05:00.0: 0x00000000 | tsf hi
iwlwifi 0000:05:00.0: 0x00000000 | time gp1
iwlwifi 0000:05:00.0: 0x0BB840A7 | time gp2
iwlwifi 0000:05:00.0: 0x00000001 | uCode revision type
iwlwifi 0000:05:00.0: 0x00000053 | uCode version major
iwlwifi 0000:05:00.0: 0xEC13314B | uCode version minor
iwlwifi 0000:05:00.0: 0x00000472 | hw version
iwlwifi 0000:05:00.0: 0x00C80002 | board version
iwlwifi 0000:05:00.0: 0x03B7001C | hcmd
iwlwifi 0000:05:00.0: 0x67F68000 | isr0
iwlwifi 0000:05:00.0: 0x01400000 | isr1
iwlwifi 0000:05:00.0: 0x48F0001A | isr2
iwlwifi 0000:05:00.0: 0x00C0040A | isr3
iwlwifi 0000:05:00.0: 0x10000000 | isr4
iwlwifi 0000:05:00.0: 0x03B6001C | last cmd Id
iwlwifi 0000:05:00.0: 0x0000F46C | wait_event
iwlwifi 0000:05:00.0: 0x00304288 | l2p_control
iwlwifi 0000:05:00.0: 0x00019C34 | l2p_duration
iwlwifi 0000:05:00.0: 0x02001A5A | l2p_mhvalid
iwlwifi 0000:05:00.0: 0x000001D8 | l2p_addr_match
iwlwifi 0000:05:00.0: 0x00000009 | lmpm_pmg_sel
iwlwifi 0000:05:00.0: 0x00000000 | timestamp
iwlwifi 0000:05:00.0: 0x0000C828 | flow_handler
iwlwifi 0000:05:00.0: Start IWL Error Log Dump:
iwlwifi 0000:05:00.0: Transport status: 0x0000004A, valid: 6
iwlwifi 0000:05:00.0: Loaded firmware version: 83.ec13314b.0 gl-c0-fm-c0-83.ucode
iwlwifi 0000:05:00.0: 0x00000084 | NMI_INTERRUPT_UNKNOWN
iwlwifi 0000:05:00.0: 0x000002F0 | trm_hw_status0
iwlwifi 0000:05:00.0: 0x00000000 | trm_hw_status1
iwlwifi 0000:05:00.0: 0x002C280A | branchlink2
iwlwifi 0000:05:00.0: 0x002B79C6 | interruptlink1
iwlwifi 0000:05:00.0: 0x002B79C6 | interruptlink2
iwlwifi 0000:05:00.0: 0x002A50FC | data1
iwlwifi 0000:05:00.0: 0x01000000 | data2
iwlwifi 0000:05:00.0: 0x00000000 | data3
iwlwifi 0000:05:00.0: 0xA0005E44 | beacon time
iwlwifi 0000:05:00.0: 0x2806818F | tsf low
iwlwifi 0000:05:00.0: 0x00000000 | tsf hi
iwlwifi 0000:05:00.0: 0x00000000 | time gp1
iwlwifi 0000:05:00.0: 0x0BB840A6 | time gp2
iwlwifi 0000:05:00.0: 0x00000001 | uCode revision type
iwlwifi 0000:05:00.0: 0x00000053 | uCode version major
iwlwifi 0000:05:00.0: 0xEC13314B | uCode version minor
iwlwifi 0000:05:00.0: 0x00000472 | hw version
iwlwifi 0000:05:00.0: 0x00C80002 | board version
iwlwifi 0000:05:00.0: 0x809DFC4D | hcmd
iwlwifi 0000:05:00.0: 0x00020000 | isr0
iwlwifi 0000:05:00.0: 0x00000000 | isr1
iwlwifi 0000:05:00.0: 0x48F00002 | isr2
iwlwifi 0000:05:00.0: 0x00C0000C | isr3
iwlwifi 0000:05:00.0: 0x00000000 | isr4
iwlwifi 0000:05:00.0: 0x00000000 | last cmd Id
iwlwifi 0000:05:00.0: 0x002A50FC | wait_event
iwlwifi 0000:05:00.0: 0x00000000 | l2p_control
iwlwifi 0000:05:00.0: 0x00000000 | l2p_duration
iwlwifi 0000:05:00.0: 0x003C0000 | l2p_mhvalid
iwlwifi 0000:05:00.0: 0x00000007 | l2p_addr_match
iwlwifi 0000:05:00.0: 0x00000028 | lmpm_pmg_sel
iwlwifi 0000:05:00.0: 0x00000000 | timestamp
iwlwifi 0000:05:00.0: 0x0000C828 | flow_handler
iwlwifi 0000:05:00.0: Start IWL Error Log Dump:
iwlwifi 0000:05:00.0: Transport status: 0x0000004A, valid: 7
iwlwifi 0000:05:00.0: 0x20000066 | NMI_INTERRUPT_HOST
iwlwifi 0000:05:00.0: 0x00000000 | umac branchlink1
iwlwifi 0000:05:00.0: 0xC00809B0 | umac branchlink2
iwlwifi 0000:05:00.0: 0x802698E4 | umac interruptlink1
iwlwifi 0000:05:00.0: 0x0107AD64 | umac interruptlink2
iwlwifi 0000:05:00.0: 0x01000000 | umac data1
iwlwifi 0000:05:00.0: 0x0107AD64 | umac data2
iwlwifi 0000:05:00.0: 0x00000000 | umac data3
iwlwifi 0000:05:00.0: 0x00000053 | umac major
iwlwifi 0000:05:00.0: 0xEC13314B | umac minor
iwlwifi 0000:05:00.0: 0x0BB8409B | frame pointer
iwlwifi 0000:05:00.0: 0xD00D625C | stack pointer
iwlwifi 0000:05:00.0: 0x0016010C | last host cmd
iwlwifi 0000:05:00.0: 0x00000400 | isr status reg
iwlwifi 0000:05:00.0: TCM1 status:
iwlwifi 0000:05:00.0: 0x00000070 | error ID
iwlwifi 0000:05:00.0: 0x0000184E | tcm branchlink2
iwlwifi 0000:05:00.0: 0x00001C44 | tcm interruptlink1
iwlwifi 0000:05:00.0: 0x00001C44 | tcm interruptlink2
iwlwifi 0000:05:00.0: 0x40000000 | tcm data1
iwlwifi 0000:05:00.0: 0xDEADBEEF | tcm data2
iwlwifi 0000:05:00.0: 0xDEADBEEF | tcm data3
iwlwifi 0000:05:00.0: 0x000018AC | tcm log PC
iwlwifi 0000:05:00.0: 0x00803FF0 | tcm frame pointer
iwlwifi 0000:05:00.0: 0x00803F4C | tcm stack pointer
iwlwifi 0000:05:00.0: 0x00000000 | tcm msg ID
iwlwifi 0000:05:00.0: 0x4000000F | tcm ISR status
iwlwifi 0000:05:00.0: 0x00000003 | tcm HW status[0]
iwlwifi 0000:05:00.0: 0x00000000 | tcm HW status[1]
iwlwifi 0000:05:00.0: 0x00019C34 | tcm HW status[2]
iwlwifi 0000:05:00.0: 0x40024148 | tcm HW status[3]
iwlwifi 0000:05:00.0: 0x00000001 | tcm HW status[4]
iwlwifi 0000:05:00.0: 0x00000000 | tcm SW status[0]
iwlwifi 0000:05:00.0: RCM1 status:
iwlwifi 0000:05:00.0: 0x00000070 | error ID
iwlwifi 0000:05:00.0: 0x00001B9E | rcm branchlink2
iwlwifi 0000:05:00.0: 0x00000648 | rcm interruptlink1
iwlwifi 0000:05:00.0: 0x00000648 | rcm interruptlink2
iwlwifi 0000:05:00.0: 0x20000000 | rcm data1
iwlwifi 0000:05:00.0: 0xDEADBEEF | rcm data2
iwlwifi 0000:05:00.0: 0xDEADBEEF | rcm data3
iwlwifi 0000:05:00.0: 0x00001C00 | rcm log PC
iwlwifi 0000:05:00.0: 0x00803FF0 | rcm frame pointer
iwlwifi 0000:05:00.0: 0x00803EB8 | rcm stack pointer
iwlwifi 0000:05:00.0: 0x00000000 | rcm msg ID
iwlwifi 0000:05:00.0: 0x20003080 | rcm ISR status
iwlwifi 0000:05:00.0: 0x3E6202CD | frame HW status
iwlwifi 0000:05:00.0: 0x00000000 | LMAC-to-RCM request mbox
iwlwifi 0000:05:00.0: 0x00000000 | RCM-to-LMAC request mbox
iwlwifi 0000:05:00.0: 0x00004288 | MAC header control
iwlwifi 0000:05:00.0: 0x72DF0990 | MAC header addr1 low
iwlwifi 0000:05:00.0: 0x02001A5A | MAC header info
iwlwifi 0000:05:00.0: 0x00000000 | MAC header error
iwlwifi 0000:05:00.0: TCM2 status:
iwlwifi 0000:05:00.0: 0x00000070 | error ID
iwlwifi 0000:05:00.0: 0x0000184E | tcm branchlink2
iwlwifi 0000:05:00.0: 0x00001C44 | tcm interruptlink1
iwlwifi 0000:05:00.0: 0x00001C44 | tcm interruptlink2
iwlwifi 0000:05:00.0: 0x40000000 | tcm data1
iwlwifi 0000:05:00.0: 0xDEADBEEF | tcm data2
iwlwifi 0000:05:00.0: 0xDEADBEEF | tcm data3
iwlwifi 0000:05:00.0: 0x000018AC | tcm log PC
iwlwifi 0000:05:00.0: 0x00803FF0 | tcm frame pointer
iwlwifi 0000:05:00.0: 0x00803F4C | tcm stack pointer
iwlwifi 0000:05:00.0: 0x00000000 | tcm msg ID
iwlwifi 0000:05:00.0: 0x40000000 | tcm ISR status
iwlwifi 0000:05:00.0: 0x000002F0 | tcm HW status[0]
iwlwifi 0000:05:00.0: 0x00000000 | tcm HW status[1]
iwlwifi 0000:05:00.0: 0x00000000 | tcm HW status[2]
iwlwifi 0000:05:00.0: 0x00004008 | tcm HW status[3]
iwlwifi 0000:05:00.0: 0x00000000 | tcm HW status[4]
iwlwifi 0000:05:00.0: 0x00000000 | tcm SW status[0]
iwlwifi 0000:05:00.0: RCM2 status:
iwlwifi 0000:05:00.0: 0x00000070 | error ID
iwlwifi 0000:05:00.0: 0x00001B9E | rcm branchlink2
iwlwifi 0000:05:00.0: 0x00002178 | rcm interruptlink1
iwlwifi 0000:05:00.0: 0x00002178 | rcm interruptlink2
iwlwifi 0000:05:00.0: 0x20000000 | rcm data1
iwlwifi 0000:05:00.0: 0xDEADBEEF | rcm data2
iwlwifi 0000:05:00.0: 0xDEADBEEF | rcm data3
iwlwifi 0000:05:00.0: 0x00001C00 | rcm log PC
iwlwifi 0000:05:00.0: 0x00803FF0 | rcm frame pointer
iwlwifi 0000:05:00.0: 0x00803F4C | rcm stack pointer
iwlwifi 0000:05:00.0: 0x00000000 | rcm msg ID
iwlwifi 0000:05:00.0: 0x20000000 | rcm ISR status
iwlwifi 0000:05:00.0: 0x00020400 | frame HW status
iwlwifi 0000:05:00.0: 0x00000000 | LMAC-to-RCM request mbox
iwlwifi 0000:05:00.0: 0x00000000 | RCM-to-LMAC request mbox
iwlwifi 0000:05:00.0: 0x00000000 | MAC header control
iwlwifi 0000:05:00.0: 0x00000000 | MAC header addr1 low
iwlwifi 0000:05:00.0: 0x003C0000 | MAC header info
iwlwifi 0000:05:00.0: 0x00000000 | MAC header error
iwlwifi 0000:05:00.0: IML/ROM dump:
iwlwifi 0000:05:00.0: 0x00000B03 | IML/ROM error/state
iwlwifi 0000:05:00.0: 0x0000DED3 | IML/ROM data1
iwlwifi 0000:05:00.0: 0x00000080 | IML/ROM WFPM_AUTH_KEY_0
iwlwifi 0000:05:00.0: Fseq Registers:
iwlwifi 0000:05:00.0: 0x66A00000 | FSEQ_ERROR_CODE
iwlwifi 0000:05:00.0: 0x80B00004 | FSEQ_TOP_INIT_VERSION
iwlwifi 0000:05:00.0: 0x00550000 | FSEQ_CNVIO_INIT_VERSION
iwlwifi 0000:05:00.0: 0x0000AA14 | FSEQ_OTP_VERSION
iwlwifi 0000:05:00.0: 0x0000000F | FSEQ_TOP_CONTENT_VERSION
iwlwifi 0000:05:00.0: 0x4552414E | FSEQ_ALIVE_TOKEN
iwlwifi 0000:05:00.0: 0x02001910 | FSEQ_CNVI_ID
iwlwifi 0000:05:00.0: 0x02001910 | FSEQ_CNVR_ID
iwlwifi 0000:05:00.0: 0x02001910 | CNVI_AUX_MISC_CHIP
iwlwifi 0000:05:00.0: 0x02001910 | CNVR_AUX_MISC_CHIP
iwlwifi 0000:05:00.0: 0x8F0F1BEF | CNVR_SCU_SD_REGS_SD_REG_DIG_DCDC_VTRIM
iwlwifi 0000:05:00.0: 0x00000000 | CNVR_SCU_SD_REGS_SD_REG_ACTIVE_VDIG_MIRROR
iwlwifi 0000:05:00.0: 0x00550000 | FSEQ_PREV_CNVIO_INIT_VERSION
iwlwifi 0000:05:00.0: 0x00B00004 | FSEQ_WIFI_FSEQ_VERSION
iwlwifi 0000:05:00.0: 0x00B00004 | FSEQ_BT_FSEQ_VERSION
iwlwifi 0000:05:00.0: 0x000000BF | FSEQ_CLASS_TP_VERSION
iwlwifi 0000:05:00.0: UMAC CURRENT PC: 0x8026935a
iwlwifi 0000:05:00.0: LMAC1 CURRENT PC: 0xd0
iwlwifi 0000:05:00.0: LMAC2 CURRENT PC: 0xd0
iwlwifi 0000:05:00.0: UMAC CURRENT PC 1: 0x80269358
iwlwifi 0000:05:00.0: TCM1 CURRENT PC: 0xd0
iwlwifi 0000:05:00.0: RCM1 CURRENT PC: 0xd0
iwlwifi 0000:05:00.0: RCM2 CURRENT PC: 0xd0
iwlwifi 0000:05:00.0: Function Scratch status:
iwlwifi 0000:05:00.0: 0x01010100 | Func Scratch
iwlwifi 0000:05:00.0: WRT: Collecting data: ini trigger 4 fired (delay=0ms).
ieee80211 phy0: Hardware restart was requested
iwlwifi 0000:05:00.0: WRT: Invalid buffer destination
iwlwifi 0000:05:00.0: Failed to send recovery cmd blob was invalid 1

SRU Justification:
==============
[Impact]
iwlwifi crashed with the following error log:
[ 282.045897] Invalid rxb from HW 0
[ 282.045941] WARNING: CPU: 3 PID: 784 at drivers/net/wireless/intel/iwlwifi/pcie/rx.c:1489 iwl_pcie_rx_handle+0x3ce/0x640 [iwlwifi]
......
[ 282.046175] CPU: 3 PID: 784 Comm: irq/185-iwlwifi Not tainted 6.5.0-1016-oem #17-Ubuntu
[ 282.046181] RIP: 0010:iwl_pcie_rx_handle+0x3ce/0x640 [iwlwifi]
[ 282.046247] Call Trace:
[ 282.046250] <IRQ>
[ 282.046254] ? show_regs+0x6d/0x80
[ 282.046264] ? __warn+0x89/0x160
[ 282.046269] ? iwl_pcie_rx_handle+0x3ce/0x640 [iwlwifi]
[ 282.046308] ? report_bug+0x17e/0x1b0
[ 282.046315] ? handle_bug+0x46/0x90
[ 282.046319] ? exc_invalid_op+0x18/0x80
[ 282.046323] ? asm_exc_invalid_op+0x1b/0x20
[ 282.046331] ? iwl_pcie_rx_handle+0x3ce/0x640 [iwlwifi]
[ 282.046366] ? iwl_pcie_rx_handle+0x3ce/0x640 [iwlwifi]
[ 282.046400] ? enqueue_task+0x10/0x1a0
[ 282.046405] iwl_pcie_napi_poll_msix+0x32/0x100 [iwlwifi]
[ 282.046440] __napi_poll+0x30/0x1f0
[ 282.046445] net_rx_action+0x181/0x2e0
[ 282.046449] ? __irq_wake_thread+0x42/0x50
[ 282.046455] __do_softirq+0xd9/0x349
[ 282.046461] ? __pfx_irq_thread_fn+0x10/0x10
[ 282.046465] do_softirq.part.0+0x41/0x80
[ 282.046471] </IRQ>
[ 282.046472] <TASK>
[ 282.046473] __local_bh_enable_ip+0x72/0x80
[ 282.046479] iwl_pcie_irq_rx_msix_handler+0xd7/0x1a0 [iwlwifi]
[ 282.046515] irq_thread_fn+0x21/0x70
[ 282.046519] irq_thread+0xf8/0x1c0
[ 282.046549] ? __pfx_irq_thread_dtor+0x10/0x10
[ 282.046554] ? __pfx_irq_thread+0x10/0x10
[ 282.046558] kthread+0xef/0x120
[ 282.046564] ? __pfx_kthread+0x10/0x10
[ 282.046570] ret_from_fork+0x44/0x70
[ 282.046575] ? __pfx_kthread+0x10/0x10
[ 282.046580] ret_from_fork_asm+0x1b/0x30
[ 282.046586] </TASK>
[ 282.046587] ---[ end trace 0000000000000000 ]---
[ 282.046976] iwlwifi 0000:09:00.0: Microcode SW error detected. Restarting 0x0.

[Fix]
From stable updates:
commit c1c1039135c3 ("wifi: iwlwifi: increase number of RX buffers for EHT devices")
increase number of RX buffers for new wifi card BE200, it needs one more
commit to support the bigger queue's RB status / write pointer.

[Test]
Tested on hardware, Intel BE200 works fine after stress with iperf3 for 20 mins.

[Where problems could occur]
It may break Intel wifi driver.

[Jacek Kowalski (kowjack)]

I also noticed 100% utilization of a single CPU thread (by the kernel) when this happens.
Probably same issue as https://bugs.launchpad.net/ubuntu/+source/linux-signed-hwe-6.5/+bug/2057484 (
kernel worker event freezes during traffic on iwlwifi)

[AceLan Kao (acelankao)]

I feel like this commit may fix the issue which is included in 6.5.0-27.28.

commit edb960c5f95228109dd8fd8056d0d28579daad7d
Author: Avraham Stern <email address hidden>
Date: Thu Dec 7 04:50:17 2023 +0200

    wifi: iwlwifi: pcie: avoid a NULL pointer dereference

    BugLink: https://bugs.launchpad.net/bugs/2055199

    [ Upstream commit ce038edfce43fb345f8dfdca0f7b17f535896701 ]

    It possible that while the rx rb is being handled, the transport has
    been stopped and re-started. In this case the tx queue pointer is not
    yet initialized, which will lead to a NULL pointer dereference.
    Fix it.

    Signed-off-by: Avraham Stern <email address hidden>
    Signed-off-by: Miri Korenblit <email address hidden>
    Link: https://msgid.link/20231207044813.cd0898cafd89.I0b84daae753ba9612092bf383f5c6f761446e964@changeid
    Signed-off-by: Johannes Berg <email address hidden>
    Signed-off-by: Sasha Levin <email address hidden>
    Signed-off-by: Manuel Diewald <email address hidden>
    Signed-off-by: Stefan Bader <email address hidden>

[Nick Kay (5urg3)]

Having this same issue now. Running Jammy kernel 6.5.0-1019-OEM. How can I fix it?

[AaronMa (mapengyu)]

@Nick

Please rollback to oem-6.5.0-1014 or 6.5.0-17 until the next release of kernel version.
The kernel version info will be updated in this bug.

[Nick Kay (5urg3)]

Thank you! oem-6.5.0-1014 works

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux/6.5.0-28.29 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-mantic-linux' to 'verification-done-mantic-linux'. If the problem still exists, change the tag 'verification-needed-mantic-linux' to 'verification-failed-mantic-linux'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[AaronMa (mapengyu)]

Tested proposed kernel version 6.5.0-28-generic and 6.5.0-1020-oem in ppa2,

iperf3 tested for 10 mins without error in dmesg:
[ ID] Interval Transfer Bitrate
[ 5] 0.00-659.00 sec 0.00 Bytes 0.00 bits/sec sender
[ 5] 0.00-659.00 sec 8.61 GBytes 112 Mbits/sec receiver

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-oem-6.5 - 6.5.0-1020.21

---------------
linux-oem-6.5 (6.5.0-1020.21) jammy; urgency=medium

  * jammy/linux-oem-6.5: 6.5.0-1020.21 -proposed tracker (LP: #2059705)

  * Packaging resync (LP: #1786013)
    - [Packaging] update variants
    - debian.oem/dkms-versions -- update from kernel-versions (main/s2024.03.04)

  * Support USB serial port for Dell DW5826e WWAN (LP: #2058452)
    - USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e

  [ Ubuntu: 6.5.0-28.29 ]

  * mantic/linux: 6.5.0-28.29 -proposed tracker (LP: #2059706)
  * Packaging resync (LP: #1786013)
    - [Packaging] drop getabis data
  * Remove getabis scripts (LP: #2059143)
    - [Packaging] Remove getabis
  * CVE-2023-52600
    - jfs: fix uaf in jfs_evict_inode
  * Mantic update: upstream stable patchset 2024-03-27 (LP: #2059284) //
    CVE-2023-52603
    - UBSAN: array-index-out-of-bounds in dtSplitRoot
  * CVE-2024-26581
    - netfilter: nft_set_rbtree: skip end interval element from gc
  * Mantic update: upstream stable patchset 2024-03-07 (LP: #2056403) //
    CVE-2024-26589
    - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
  * Mantic update: upstream stable patchset 2024-03-07 (LP: #2056403) //
    CVE-2024-26591
    - bpf: Fix re-attachment branch in bpf_tracing_prog_attach
  * iwlwifi disconnect and crash - intel wifi7 (LP: #2058808)
    - wifi: iwlwifi: pcie: fix RB status reading

 -- Timo Aaltonen <email address hidden> Wed, 03 Apr 2024 16:18:18 +0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 6.5.0-28.29

---------------
linux (6.5.0-28.29) mantic; urgency=medium

  * mantic/linux: 6.5.0-28.29 -proposed tracker (LP: #2059706)

  * Packaging resync (LP: #1786013)
    - [Packaging] drop getabis data

  * Remove getabis scripts (LP: #2059143)
    - [Packaging] Remove getabis

  * CVE-2023-52600
    - jfs: fix uaf in jfs_evict_inode

  * Mantic update: upstream stable patchset 2024-03-27 (LP: #2059284) //
    CVE-2023-52603
    - UBSAN: array-index-out-of-bounds in dtSplitRoot

  * CVE-2024-26581
    - netfilter: nft_set_rbtree: skip end interval element from gc

  * Mantic update: upstream stable patchset 2024-03-07 (LP: #2056403) //
    CVE-2024-26589
    - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS

  * Mantic update: upstream stable patchset 2024-03-07 (LP: #2056403) //
    CVE-2024-26591
    - bpf: Fix re-attachment branch in bpf_tracing_prog_attach

  * iwlwifi disconnect and crash - intel wifi7 (LP: #2058808)
    - wifi: iwlwifi: pcie: fix RB status reading

 -- Manuel Diewald <email address hidden> Thu, 28 Mar 2024 19:28:42 +0100

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-azure-6.5/6.5.0-1019.20~22.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-azure-6.5' to 'verification-done-jammy-linux-azure-6.5'. If the problem still exists, change the tag 'verification-needed-jammy-linux-azure-6.5' to 'verification-failed-jammy-linux-azure-6.5'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-lowlatency-hwe-6.5/6.5.0-28.29.1~22.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-lowlatency-hwe-6.5' to 'verification-done-jammy-linux-lowlatency-hwe-6.5'. If the problem still exists, change the tag 'verification-needed-jammy-linux-lowlatency-hwe-6.5' to 'verification-failed-jammy-linux-lowlatency-hwe-6.5'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Jacek Kowalski (kowjack)]

I have tested wifi7 with latest linux-generic-hwe-22.04 with 6.5.0-28-generic #29~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Apr 4 14:39:20 UTC 2 x86_64 x86_64 x86_64 GNU/Linux.

The problem with iwlwifi(and wifi7) no longer exists - no disconnects, no crash, no unusual errors messages in dmesg. Thanks.

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-azure/6.5.0-1021.22 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-mantic-linux-azure' to 'verification-done-mantic-linux-azure'. If the problem still exists, change the tag 'verification-needed-mantic-linux-azure' to 'verification-failed-mantic-linux-azure'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!