Redpine vendor driver - Switching to AP mode causes kernel panic

Bug #1700941 reported by Shrirang Bagul on 2017-06-28
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
HWE Next
Critical
Shrirang Bagul
linux (Ubuntu)
Critical
Unassigned
Xenial
Undecided
Unassigned

Bug Description

Switching from STA to AP mode on RS9113 Redpine Wifi-BT combo device, system reports a kernel panic.

The Redpine driver (ver. 1.2 RC12) doesn't track the Linux 4.4.69 stable release
which introduced following patches to mac80211 subsystem:
- mac80211: pass RX aggregation window size to driver
- mac80211: pass block ack session timeout to to driver
- mac80211: RX BA support for sta max_rx_aggregation_subframes

The Redpine driver ver. 1.2RC12 needs to be updated to handle the changes introduced
in the patch:
- mac80211: pass block ack session timeout to to driver
(more details here: http://kernel.ubuntu.com/git/ubuntu/ubuntu-xenial.git/commit/?h=U
buntu-4.4.0-82.105&id=0b2141bd007213cc9c4228786f773a3c35c41c56 and https://bugs.launc
hpad.net/bugs/1692900)

CVE References

Shrirang Bagul (shrirang-bagul) wrote :
Shrirang Bagul (shrirang-bagul) wrote :
Changed in linux (Ubuntu):
status: New → Confirmed
importance: Undecided → Critical
tags: added: originate-from-1699686 plano
Changed in hwe-next:
importance: Undecided → Critical
status: New → Confirmed
assignee: nobody → Shrirang Bagul (shrirang-bagul)
Changed in linux (Ubuntu):
status: Confirmed → In Progress
Changed in hwe-next:
status: Confirmed → In Progress
Changed in linux (Ubuntu):
status: In Progress → Confirmed
Changed in linux (Ubuntu):
status: Confirmed → In Progress
Stefan Bader (smb) on 2017-07-20
Changed in linux (Ubuntu Xenial):
status: New → Fix Committed

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-xenial' to 'verification-done-xenial'. If the problem still exists, change the tag 'verification-needed-xenial' to 'verification-failed-xenial'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-xenial

Hi @Shrirang,

Could you please verify if the Xenial kernel currently on -proposed fixes the issue?

Thanks,
Kleber

Shrirang Bagul (shrirang-bagul) wrote :

Hi @Kleber,

This driver was verified on a test kernel snap based on Ubuntu Xenial 4.4.0-85.108
(published here: http://kernel.ubuntu.com/git/snb/ubuntu-xenial.git/log/?h=caracalla-lp-for-kt)

The kernel snap for QA testing will be built from the kernel in -updates.

Thanks,
Shrirang

Tagging bug with verification-done-xenial since the driver has been tested on a Xenial-based snap.

Thanks, @Shrirang.

tags: added: verification-done-xenial
removed: verification-needed-xenial
Launchpad Janitor (janitor) wrote :
Download full text (12.0 KiB)

This bug was fixed in the package linux - 4.4.0-89.112

---------------
linux (4.4.0-89.112) xenial; urgency=low

  * CVE-2017-7533
    - dentry name snapshots

linux (4.4.0-88.111) xenial; urgency=low

  * linux: 4.4.0-88.111 -proposed tracker (LP: #1705270)

  * [Xenial] nvme: Quirks for PM1725 controllers (LP: #1704435)
    - nvme: Quirks for PM1725 controllers

  * Upgrade Redpine WLAN/BT driver to ver. 1.2 (production release)
    (LP: #1697829)
    - SAUCE: Redpine: Upgrade to ver. 1.2 production release

  * ubuntu/rsi driver has several issues as picked up by static analysis
    (LP: #1694733)
    - SAUCE: Redpine: Upgrade to ver. 1.2 production release

  * Redpine vendor driver - Switching to AP mode causes kernel panic
    (LP: #1700941)
    - SAUCE: Redpine: Upgrade to ver. 1.2 production release

  * CVE-2017-10810
    - drm/virtio: don't leak bo on drm_gem_object_init failure

  * Ath10k to read different board data file if specify in SMBIOS (LP: #1666742)
    - ath10k: search SMBIOS for OEM board file extension

  * make snap-pkg support (LP: #1700747)
    - SAUCE: make snap-pkg support

  * ISST-LTE: Briggs:Stratton:UbuntuKVM: ics_opal_set_affinity on host kernel
    log using Intel X710 (i40e driver) (LP: #1703663)
    - i40e: use valid online CPU on q_vector initialization

  * Update snapcraft.yaml (LP: #1700480)
    - snapcraft.yaml: various improvements

  * Xenial update to 4.4.76 stable release (LP: #1702863)
    - ipv6: release dst on error in ip6_dst_lookup_tail
    - net: don't call strlen on non-terminated string in dev_set_alias()
    - decnet: dn_rtmsg: Improve input length sanitization in
      dnrmg_receive_user_skb
    - net: Zero ifla_vf_info in rtnl_fill_vfinfo()
    - af_unix: Add sockaddr length checks before accessing sa_family in bind and
      connect handlers
    - Fix an intermittent pr_emerg warning about lo becoming free.
    - net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx
    - igmp: acquire pmc lock for ip_mc_clear_src()
    - igmp: add a missing spin_lock_init()
    - ipv6: fix calling in6_ifa_hold incorrectly for dad work
    - net/mlx5: Wait for FW readiness before initializing command interface
    - decnet: always not take dst->__refcnt when inserting dst into hash table
    - net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev
    - sfc: provide dummy definitions of vswitch functions
    - ipv6: Do not leak throw route references
    - rtnetlink: add IFLA_GROUP to ifla_policy
    - netfilter: xt_TCPMSS: add more sanity tests on tcph->doff
    - netfilter: synproxy: fix conntrackd interaction
    - NFSv4: fix a reference leak caused WARNING messages
    - drm/ast: Handle configuration without P2A bridge
    - mm, swap_cgroup: reschedule when neeed in swap_cgroup_swapoff()
    - MIPS: Avoid accidental raw backtrace
    - MIPS: pm-cps: Drop manual cache-line alignment of ready_count
    - MIPS: Fix IRQ tracing & lockdep when rescheduling
    - ALSA: hda - Fix endless loop of codec configure
    - ALSA: hda - set input_path bitmap to zero after moving it to new place
    - drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr
    - usb: gadget: f_fs: Fix possi...

Changed in linux (Ubuntu Xenial):
status: Fix Committed → Fix Released
Changed in linux (Ubuntu):
status: In Progress → Fix Released
Changed in hwe-next:
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers