Fix mediatek wifi driver crash when loading wrong SAR table

[AaronMa]

[Impact]
Mediatek MT7922 wifi driver crashed on some laptops.

[Fix]
WiFi driver should not continue initializing SAR table when it's
invalid.

[Test]
Verified on hardware and stress netword passed.

[Where problems could occur]
Low risk.
It may cause issues on mt76 driver.

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 2009118

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-oem-6.1/6.1.0-1008.8 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy' to 'verification-done-jammy'. If the problem still exists, change the tag 'verification-needed-jammy' to 'verification-failed-jammy'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[AaronMa (mapengyu)]

It's fixed now in proposed kernel linux-oem-6.1/6.1.0-1008.8

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 6.2.0-18.18

---------------
linux (6.2.0-18.18) lunar; urgency=medium

  * lunar/linux: 6.2.0-18.18 -proposed tracker (LP: #2011750)

  * lunar/linux 6.2 fails to boot on arm64 (LP: #2011748)
    - SAUCE: Revert "efi: random: fix NULL-deref when refreshing seed"
    - SAUCE: Revert "efi: random: refresh non-volatile random seed when RNG is
      initialized"

 -- Andrea Righi <email address hidden> Wed, 15 Mar 2023 23:54:18 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-oem-6.1 - 6.1.0-1008.8

---------------
linux-oem-6.1 (6.1.0-1008.8) jammy; urgency=medium

  * jammy/linux-oem-6.1: 6.1.0-1008.8 -proposed tracker (LP: #2008352)

  * overlayfs mounts as R/O over idmapped mount (LP: #2009065)
    - SAUCE: overlayfs: handle idmapped mounts in ovl_do_(set|remove)xattr

  * Some QHD panels fail to refresh when PSR2 enabled (LP: #2009014)
    - SAUCE: drm/i915/psr: Use calculated io and fast wake lines

  * Fix mediatek wifi driver crash when loading wrong SAR table (LP: #2009118)
    - wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read

  * Packaging resync (LP: #1786013)
    - [Packaging] update update.conf

  * Update dg2_dmc to 2.08 (LP: #1999375)
    - drm/i915/dmc: Update DG2 DMC version to v2.08

  * New DG2 workarounds (LP: #2006945)
    - drm/i915/dg2: Introduce Wa_18017747507
    - drm/i915/dg2: Introduce Wa_18018764978
    - drm/i915/dg2: Introduce Wa_18019271663

  * Screen backlight keeps in minimized and can't change it with amdgpu
    (LP: #2008871)
    - SAUCE: ACPI: video: Add backlight=native DMI quirk for Dell Vostro 15 3535

  * Remove all other acpi_video backlight interface on Dell AIO platforms
    (LP: #2008882)
    - SAUCE: ACPI: video: Dell AIO UART backlight detection

  * screen flicker after PSR2 enabled (LP: #2007516)
    - SAUCE: drm/i915/display/psr: Disable PSR2 sel fetch on panel SHP 5457

  * rtcpie in timers from ubuntu_kernel_selftests randomly failing
    (LP: #1814234)
    - SAUCE: selftest: rtcpie: Force passing unreliable subtest

  * Fix HFP mSBC support on Realtek Bluetooth USB controller (LP: #2007331)
    - Bluetooth: btrtl: Add btrealtek data struct
    - Bluetooth: btusb: Ignore zero length of USB packets on ALT 6 for specific
      chip

  * Jammy update: v6.1.14 upstream stable release (LP: #2008708)
    - drm/etnaviv: don't truncate physical page address
    - wifi: ath11k: fix warning in dma_free_coherent() of memory chunks while
      recovery
    - wifi: rtl8xxxu: gen2: Turn on the rate control
    - drm/edid: Fix minimum bpc supported with DSC1.2 for HDMI sink
    - clk: mxl: Switch from direct readl/writel based IO to regmap based IO
    - clk: mxl: Remove redundant spinlocks
    - clk: mxl: Add option to override gate clks
    - clk: mxl: Fix a clk entry by adding relevant flags
    - powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G
    - clk: mxl: syscon_node_to_regmap() returns error pointers
    - sched/psi: Stop relying on timer_pending() for poll_work rescheduling
    - random: always mix cycle counter in add_latent_entropy()
    - scsi: libsas: Add smp_ata_check_ready_type()
    - scsi: hisi_sas: Fix SATA devices missing issue during I_T nexus reset
    - spi: mediatek: Enable irq when pdata is ready
    - docs: perf: Fix PMU instance name of hisi-pcie-pmu
    - KVM: x86: Fail emulation during EMULTYPE_SKIP on any exception
    - KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid
    - KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS
    - can: kvaser_usb: hydra: help gcc-13 to figure out cmd_len
    - powerpc: dts: t208x: Disable 10G on MAC1 and MAC2
    - spi: mediatek: ...

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux/5.15.0-70.77 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy' to 'verification-done-jammy'. If the problem still exists, change the tag 'verification-needed-jammy' to 'verification-failed-jammy'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux/5.19.0-40.41 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-kinetic' to 'verification-done-kinetic'. If the problem still exists, change the tag 'verification-needed-kinetic' to 'verification-failed-kinetic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 5.15.0-70.77

---------------
linux (5.15.0-70.77) jammy; urgency=medium

  * jammy/linux: 5.15.0-70.77 -proposed tracker (LP: #2011918)

  * CVE-2023-26545
    - net: mpls: fix stale pointer if allocation fails during device rename

  * CVE-2023-1281
    - net/sched: tcindex: update imperfect hash filters respecting rcu

  * [SRU][Ubuntu 22.04.1] mpi3mr: Add management application interface(BSG)
    support (LP: #1971151)
    - scsi: mpi3mr: Add bsg device support
    - scsi: mpi3mr: Add support for driver commands
    - scsi: mpi3mr: Move data structures/definitions from MPI headers to uapi
      header
    - scsi: mpi3mr: Add support for MPT commands
    - scsi: mpi3mr: Add support for PEL commands
    - scsi: mpi3mr: Expose adapter state to sysfs
    - scsi: mpi3mr: Add support for NVMe passthrough
    - scsi: mpi3mr: Update driver version to 8.0.0.69.0
    - scsi: mpi3mr: Increase I/O timeout value to 60s
    - scsi: mpi3mr: Hidden drives not removed during soft reset
    - scsi: mpi3mr: Return I/Os to an unrecoverable HBA with DID_ERROR
    - scsi: mpi3mr: Fix a NULL vs IS_ERR() bug in mpi3mr_bsg_init()
    - scsi: mpi3mr: Return error if dma_alloc_coherent() fails
    - scsi: mpi3mr: Add shost related sysfs attributes
    - scsi: mpi3mr: Add target device related sysfs attributes
    - scsi: mpi3mr: Rework mrioc->bsg_device model to fix warnings
    - scsi: mpi3mr: Fix kernel-doc

  * cpufreq: intel_pstate: Update Balance performance EPP for Sapphire Rapids
    (LP: #2008519)
    - cpufreq: intel_pstate: Update EPP for AlderLake mobile
    - cpufreq: intel_pstate: Adjust balance_performance EPP for Sapphire Rapids

  * Fail to output sound to external monitor which connects via docking station
    (LP: #2009024)
    - [Config] Enable CONFIG_SND_HDA_INTEL_HDMI_SILENT_STREAM

  * Fix mediatek wifi driver crash when loading wrong SAR table (LP: #2009118)
    - wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read

  * Jammy update: v5.15.92 upstream stable release (LP: #2011472)
    - ARM: dts: imx: Fix pca9547 i2c-mux node name
    - ARM: dts: vf610: Fix pca9548 i2c-mux node names
    - arm64: dts: freescale: Fix pca954x i2c-mux node names
    - arm64: dts: imx8mq-thor96: fix no-mmc property for SDHCI
    - firmware: arm_scmi: Clear stale xfer->hdr.status
    - bpf: Skip task with pid=1 in send_signal_common()
    - erofs/zmap.c: Fix incorrect offset calculation
    - blk-cgroup: fix missing pd_online_fn() while activating policy
    - HID: playstation: sanity check DualSense calibration data.
    - dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
    - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint()
    - extcon: usbc-tusb320: fix kernel-doc warning
    - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt
    - tools: fix ARRAY_SIZE defines in tools and selftests hdrs
    - selftests/vm: remove ARRAY_SIZE define from individual tests
    - selftests: Provide local define of __cpuid_count()
    - net: fix NULL pointer in skb_segment_list
    - net: mctp: purge receive queues on sk destruction
    - Linux 5.15.92

  * Jammy update: v5.15....

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 5.19.0-40.41

---------------
linux (5.19.0-40.41) kinetic; urgency=medium

  * kinetic/linux: 5.19.0-40.41 -proposed tracker (LP: #2012668)

  * CVE-2023-0468
    - io_uring: fix tw losing poll events
    - io_uring: make poll refs more robust

  * Regression in ext4 during online resize (LP: #2003816)
    - ext4: fix bad checksum after online resize
    - ext4: fix corruption when online resizing a 1K bigalloc fs
    - ext4: fix corrupt backup group descriptors after online resize

linux (5.19.0-39.40) kinetic; urgency=medium

  * kinetic/linux: 5.19.0-39.40 -proposed tracker (LP: #2011876)

  * CVE-2023-26545
    - net: mpls: fix stale pointer if allocation fails during device rename

  * CVE-2023-1032
    - net: avoid double iput when sock_alloc_file fails

  * CVE-2022-41218 // CVE-2022-41218 is assigned to those bugs above.
    - media: dvb-core: Fix UAF due to refcount races at releasing

  * CVE-2023-1281
    - net/sched: tcindex: update imperfect hash filters respecting rcu

  * linux: CONFIG_SERIAL_8250_MID=y (LP: #2009283)
    - [Config] enable CONFIG_SERIAL_8250_MID=y

  * apply the latest TDX attestation driver from Intel (LP: #2009437)
    - Revert "UBUNTU: SAUCE: selftests: tdx: Test GetReport TDX attestation
      feature"
    - Revert "UBUNTU: SAUCE: x86/tdx: Add TDX Guest attestation interface driver"
    - x86/tdx: Add a wrapper to get TDREPORT0 from the TDX Module
    - virt: Add TDX guest driver
    - selftests/tdx: Test TDX attestation GetReport support
    - [Config] enable TDX attestation driver as module by default

  * cpufreq: intel_pstate: Update Balance performance EPP for Sapphire Rapids
    (LP: #2008519)
    - cpufreq: intel_pstate: Adjust balance_performance EPP for Sapphire Rapids

  * Fail to output sound to external monitor which connects via docking station
    (LP: #2009024)
    - [Config] Enable CONFIG_SND_HDA_INTEL_HDMI_SILENT_STREAM

  * Fix mediatek wifi driver crash when loading wrong SAR table (LP: #2009118)
    - wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read

  * CVE-2022-47929
    - net: sched: disallow noqueue for qdisc classes

  * Intel graphic driver is not probing[8086:468b] (LP: #1990242)
    - drm/i915: Add new ADL-S pci id

  * Some QHD panels fail to refresh when PSR2 enabled (LP: #2009014)
    - drm/i915/psr: Use full update In case of area calculation fails
    - drm/i915: Ensure damage clip area is within pipe area
    - SAUCE: drm/i915/psr: Use calculated io and fast wake lines

  * overlayfs mounts as R/O over idmapped mount (LP: #2009065)
    - SAUCE: overlayfs: handle idmapped mounts in ovl_do_(set|remove)xattr

  * Kinetic update: upstream stable patchset 2023-02-28 (LP: #2008832)
    - usb: musb: remove extra check in musb_gadget_vbus_draw
    - arm64: dts: qcom: ipq6018-cp01-c1: use BLSPI1 pins
    - arm64: dts: qcom: sm8250-sony-xperia-edo: fix touchscreen bias-disable
    - arm64: dts: qcom: msm8996: Add MSM8996 Pro support
    - arm64: dts: qcom: msm8996: fix supported-hw in cpufreq OPP tables
    - arm64: dts: qcom: msm8996: fix GPU OPP table
    - ARM: dts: qcom: apq8064: fix coresight compatible
    - arm64: dts:...

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-hwe-5.15/5.15.0-71.78~20.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-ibm/5.19.0-1021.23 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-kinetic' to 'verification-done-kinetic'. If the problem still exists, change the tag 'verification-needed-kinetic' to 'verification-failed-kinetic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-aws/5.19.0-1025.26 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-kinetic' to 'verification-done-kinetic'. If the problem still exists, change the tag 'verification-needed-kinetic' to 'verification-failed-kinetic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-azure/5.19.0-1026.29 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-kinetic' to 'verification-done-kinetic'. If the problem still exists, change the tag 'verification-needed-kinetic' to 'verification-failed-kinetic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-aws/5.15.0-1036.40 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy' to 'verification-done-jammy'. If the problem still exists, change the tag 'verification-needed-jammy' to 'verification-failed-jammy'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-azure/5.15.0-1038.45 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy' to 'verification-done-jammy'. If the problem still exists, change the tag 'verification-needed-jammy' to 'verification-failed-jammy'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-nvidia-5.19/5.19.0-1010.10 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy' to 'verification-done-jammy'. If the problem still exists, change the tag 'verification-needed-jammy' to 'verification-failed-jammy'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-intel-iotg-5.15/5.15.0-1029.34~20.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-xilinx-zynqmp/5.15.0-1021.25 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy' to 'verification-done-jammy'. If the problem still exists, change the tag 'verification-needed-jammy' to 'verification-failed-jammy'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Jian Hui Lee (jianhuilee)]

it's not the requirement for focal/intel-iotg kernel

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-aws-5.15/5.15.0-1046.51~20.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal-linux-aws-5.15' to 'verification-done-focal-linux-aws-5.15'. If the problem still exists, change the tag 'verification-needed-focal-linux-aws-5.15' to 'verification-failed-focal-linux-aws-5.15'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-mtk/5.15.0-1030.34 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-mtk' to 'verification-done-jammy-linux-mtk'. If the problem still exists, change the tag 'verification-needed-jammy-linux-mtk' to 'verification-failed-jammy-linux-mtk'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!