Bug 215748

Summary:	UBSAN: invalid-load in drivers/net/wireless/mediatek/mt76/dma.c:162:13
Product:	Drivers	Reporter:	sander44 (ionut_n2001)
Component:	network-wireless	Assignee:	drivers_network-wireless (drivers_network-wireless)
Status:	NEW ---
Severity:	high	CC:	regressions
Priority:	P1
Hardware:	x86-64
OS:	Linux
Kernel Version:	5.17.0	Subsystem:
Regression:	No	Bisected commit-id:

Description sander44 2022-03-26 20:47:34 UTC

Hi Kernel Team,

Today i try to check this new version kernel.
But i notice more issue with mediatek wifi driver.

Vanilla Kernel 5.17.0 with Fedora Workstation 35

Please help me with this poor performance that I see on the wifi and bluetooth driver. 

Mar 26 22:10:07 fedora kernel: Bluetooth: hci0: unexpected event 0xff length: 5 > 0
Mar 26 22:10:07 fedora kernel: ================================================================================
Mar 26 22:10:07 fedora kernel: UBSAN: invalid-load in drivers/net/wireless/mediatek/mt76/dma.c:162:13
Mar 26 22:10:07 fedora kernel: Bluetooth: hci0: unexpected event 0xff length: 5 > 0
Mar 26 22:10:07 fedora kernel: load of value 89 is not a valid value for type '_Bool'
Mar 26 22:10:07 fedora kernel: CPU: 11 PID: 685 Comm: systemd-udevd Not tainted 5.17.0-custom #2
Mar 26 22:10:07 fedora kernel: Hardware name: ASUSTeK COMPUTER INC. ROG Zephyrus G14 GA401QM_GA401QM/GA401QM, BIOS GA401QM.410 12/13/2021
Mar 26 22:10:07 fedora kernel: Call Trace:
Mar 26 22:10:07 fedora kernel:  <TASK>
Mar 26 22:10:07 fedora kernel:  dump_stack_lvl+0x4c/0x63
Mar 26 22:10:07 fedora kernel:  dump_stack+0x10/0x12
Mar 26 22:10:07 fedora kernel:  ubsan_epilogue+0x9/0x45
Mar 26 22:10:07 fedora kernel:  __ubsan_handle_load_invalid_value.cold+0x44/0x49
Mar 26 22:10:07 fedora kernel:  ? iommu_dma_map_page+0xbb/0x1d0
Mar 26 22:10:07 fedora kernel:  mt76_dma_add_buf.constprop.0.cold+0x23/0x85 [mt76]
Mar 26 22:10:07 fedora kernel:  mt76_dma_rx_fill.isra.0+0x102/0x1f0 [mt76]
Mar 26 22:10:07 fedora kernel:  mt76_dma_init+0xc9/0x150 [mt76]
Mar 26 22:10:07 fedora kernel:  ? mt7921_dma_enable+0x2a0/0x2a0 [mt7921e]
Mar 26 22:10:07 fedora kernel:  mt7921_dma_init+0x1f7/0x270 [mt7921e]
Mar 26 22:10:07 fedora kernel:  mt7921_pci_probe+0x1e4/0x230 [mt7921e]
Mar 26 22:10:07 fedora kernel:  ? __pm_runtime_resume+0x60/0x80
Mar 26 22:10:07 fedora kernel:  local_pci_probe+0x4b/0x90
Mar 26 22:10:07 fedora kernel:  ? pci_match_device+0xde/0x130
Mar 26 22:10:07 fedora kernel:  pci_device_probe+0xc8/0x200
Mar 26 22:10:07 fedora kernel:  really_probe+0x21e/0x400
Mar 26 22:10:07 fedora kernel:  __driver_probe_device+0x115/0x190
Mar 26 22:10:07 fedora kernel:  driver_probe_device+0x23/0xc0
Mar 26 22:10:07 fedora kernel:  __driver_attach+0xbd/0x1d0
Mar 26 22:10:07 fedora kernel:  ? __device_attach_driver+0x110/0x110
Mar 26 22:10:07 fedora kernel:  bus_for_each_dev+0x7e/0xc0
Mar 26 22:10:07 fedora kernel:  driver_attach+0x1e/0x20
Mar 26 22:10:07 fedora kernel:  bus_add_driver+0x161/0x200
Mar 26 22:10:07 fedora kernel:  driver_register+0x95/0xf0
Mar 26 22:10:07 fedora kernel:  ? 0xffffffffc192f000
Mar 26 22:10:07 fedora kernel:  __pci_register_driver+0x68/0x70
Mar 26 22:10:07 fedora kernel:  mt7921_pci_driver_init+0x23/0x1000 [mt7921e]
Mar 26 22:10:07 fedora kernel:  do_one_initcall+0x48/0x210
Mar 26 22:10:07 fedora kernel:  ? kmem_cache_alloc_trace+0x1a6/0x320
Mar 26 22:10:07 fedora kernel:  do_init_module+0x52/0x250
Mar 26 22:10:07 fedora kernel:  load_module+0x27c9/0x2bc0
Mar 26 22:10:07 fedora kernel:  __do_sys_finit_module+0xc5/0x130
Mar 26 22:10:07 fedora kernel:  ? __do_sys_finit_module+0xc5/0x130
Mar 26 22:10:07 fedora kernel:  __x64_sys_finit_module+0x18/0x20
Mar 26 22:10:07 fedora kernel:  do_syscall_64+0x5c/0xc0
Mar 26 22:10:07 fedora kernel:  ? do_syscall_64+0x69/0xc0
Mar 26 22:10:07 fedora kernel:  ? sysvec_call_function+0x4e/0x90
Mar 26 22:10:07 fedora kernel:  ? asm_sysvec_call_function+0xa/0x20
Mar 26 22:10:07 fedora kernel:  entry_SYSCALL_64_after_hwframe+0x44/0xae
Mar 26 22:10:07 fedora kernel: RIP: 0033:0x7f585b883ecd
Mar 26 22:10:07 fedora kernel: Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 2b ef 0e 00 f7 d8 64 89 01 48
Mar 26 22:10:07 fedora kernel: RSP: 002b:00007fff19e3dde8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
Mar 26 22:10:07 fedora kernel: RAX: ffffffffffffffda RBX: 0000562ef5698190 RCX: 00007f585b883ecd
Mar 26 22:10:07 fedora kernel: RDX: 0000000000000000 RSI: 00007f585b9ea32c RDI: 0000000000000013
Mar 26 22:10:07 fedora kernel: RBP: 0000000000020000 R08: 0000000000000000 R09: 0000000000000002
Mar 26 22:10:07 fedora kernel: R10: 0000000000000013 R11: 0000000000000246 R12: 00007f585b9ea32c
Mar 26 22:10:07 fedora kernel: R13: 0000562ef5699cf0 R14: 0000000000000007 R15: 0000562ef5784c70
Mar 26 22:10:07 fedora kernel:  </TASK>
Mar 26 22:10:07 fedora kernel: ================================================================================
Mar 26 22:10:07 fedora kernel: Bluetooth: hci0: unexpected event 0xff length: 5 > 0
Mar 26 22:10:07 fedora kernel: Bluetooth: hci0: unexpected event 0xff length: 5 > 0
Mar 26 22:10:07 fedora kernel: Bluetooth: hci0: unexpected event 0xff length: 5 > 0
Mar 26 22:10:07 fedora kernel: Bluetooth: hci0: unexpected event 0xff length: 5 > 0
Mar 26 22:10:07 fedora kernel: Bluetooth: hci0: unexpected event 0xff length: 5 > 0
Mar 26 22:10:07 fedora kernel: mt7921e 0000:02:00.0: HW/SW Version: 0x8a108a10, Build Time: 20220209150832a
Mar 26 22:10:07 fedora kernel: Bluetooth: hci0: unexpected event 0xff length: 5 > 0
Mar 26 22:10:07 fedora kernel: Bluetooth: hci0: unexpected event 0xff length: 5 > 0
Mar 26 22:10:07 fedora kernel: Bluetooth: hci0: unexpected event 0xff length: 5 > 0
Mar 26 22:10:07 fedora kernel: Bluetooth: hci0: unexpected event 0xff length: 5 > 0
Mar 26 22:10:07 fedora kernel: Bluetooth: hci0: unexpected event 0xff length: 5 > 0
Mar 26 22:10:07 fedora kernel: Bluetooth: hci0: unexpected event 0xff length: 5 > 0
Mar 26 22:10:07 fedora kernel: Bluetooth: hci0: unexpected event 0xff length: 5 > 0
Mar 26 22:10:07 fedora kernel: Bluetooth: hci0: unexpected event 0xff length: 5 > 0
Mar 26 22:10:07 fedora kernel: Bluetooth: hci0: unexpected event 0xff length: 5 > 0
Mar 26 22:10:07 fedora kernel: Bluetooth: hci0: unexpected event 0xff length: 5 > 0
Mar 26 22:10:07 fedora kernel: Bluetooth: hci0: unexpected event 0xff length: 5 > 0


lspci
00:00.0 Host bridge: Advanced Micro Devices, Inc. [AMD] Renoir/Cezanne Root Complex
00:00.2 IOMMU: Advanced Micro Devices, Inc. [AMD] Renoir/Cezanne IOMMU
00:01.0 Host bridge: Advanced Micro Devices, Inc. [AMD] Renoir PCIe Dummy Host Bridge
00:01.1 PCI bridge: Advanced Micro Devices, Inc. [AMD] Renoir PCIe GPP Bridge
00:02.0 Host bridge: Advanced Micro Devices, Inc. [AMD] Renoir PCIe Dummy Host Bridge
00:02.2 PCI bridge: Advanced Micro Devices, Inc. [AMD] Renoir/Cezanne PCIe GPP Bridge
00:02.4 PCI bridge: Advanced Micro Devices, Inc. [AMD] Renoir/Cezanne PCIe GPP Bridge
00:08.0 Host bridge: Advanced Micro Devices, Inc. [AMD] Renoir PCIe Dummy Host Bridge
00:08.1 PCI bridge: Advanced Micro Devices, Inc. [AMD] Renoir Internal PCIe GPP Bridge to Bus
00:14.0 SMBus: Advanced Micro Devices, Inc. [AMD] FCH SMBus Controller (rev 51)
00:14.3 ISA bridge: Advanced Micro Devices, Inc. [AMD] FCH LPC Bridge (rev 51)
00:18.0 Host bridge: Advanced Micro Devices, Inc. [AMD] Cezanne Data Fabric; Function 0
00:18.1 Host bridge: Advanced Micro Devices, Inc. [AMD] Cezanne Data Fabric; Function 1
00:18.2 Host bridge: Advanced Micro Devices, Inc. [AMD] Cezanne Data Fabric; Function 2
00:18.3 Host bridge: Advanced Micro Devices, Inc. [AMD] Cezanne Data Fabric; Function 3
00:18.4 Host bridge: Advanced Micro Devices, Inc. [AMD] Cezanne Data Fabric; Function 4
00:18.5 Host bridge: Advanced Micro Devices, Inc. [AMD] Cezanne Data Fabric; Function 5
00:18.6 Host bridge: Advanced Micro Devices, Inc. [AMD] Cezanne Data Fabric; Function 6
00:18.7 Host bridge: Advanced Micro Devices, Inc. [AMD] Cezanne Data Fabric; Function 7
01:00.0 VGA compatible controller: NVIDIA Corporation GA106M [GeForce RTX 3060 Mobile / Max-Q] (rev a1)
01:00.1 Audio device: NVIDIA Corporation Device 228e (rev a1)
02:00.0 Network controller: MEDIATEK Corp. MT7921 802.11ax PCI Express Wireless Network Adapter
03:00.0 Non-Volatile memory controller: Intel Corporation Device f1aa (rev 03)
04:00.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] Cezanne (rev c4)
04:00.1 Audio device: Advanced Micro Devices, Inc. [AMD/ATI] Renoir Radeon High Definition Audio Controller
04:00.2 Encryption controller: Advanced Micro Devices, Inc. [AMD] Family 17h (Models 10h-1fh) Platform Security Processor
04:00.3 USB controller: Advanced Micro Devices, Inc. [AMD] Renoir/Cezanne USB 3.1
04:00.4 USB controller: Advanced Micro Devices, Inc. [AMD] Renoir/Cezanne USB 3.1
04:00.5 Multimedia controller: Advanced Micro Devices, Inc. [AMD] ACP/ACP3X/ACP6x Audio Coprocessor (rev 01)
04:00.6 Audio device: Advanced Micro Devices, Inc. [AMD] Family 17h/19h HD Audio Controller


lspci -s 02:00.0 -vvnnkk
02:00.0 Network controller [0280]: MEDIATEK Corp. MT7921 802.11ax PCI Express Wireless Network Adapter [14c3:7961]
	Subsystem: AzureWave Device [1a3b:4680]
	Physical Slot: 0-1
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0, Cache Line Size: 64 bytes
	Interrupt: pin A routed to IRQ 73
	IOMMU group: 9
	Region 0: Memory at fe20300000 (64-bit, prefetchable) [size=1M]
	Region 2: Memory at fe20400000 (64-bit, prefetchable) [size=16K]
	Region 4: Memory at fe20404000 (64-bit, prefetchable) [size=4K]
	Capabilities: [80] Express (v2) Endpoint, MSI 00
		DevCap:	MaxPayload 128 bytes, PhantFunc 0, Latency L0s unlimited, L1 unlimited
			ExtTag+ AttnBtn- AttnInd- PwrInd- RBE+ FLReset+ SlotPowerLimit 75.000W
		DevCtl:	CorrErr- NonFatalErr- FatalErr- UnsupReq-
			RlxdOrd+ ExtTag+ PhantFunc- AuxPwr- NoSnoop+ FLReset-
			MaxPayload 128 bytes, MaxReadReq 512 bytes
		DevSta:	CorrErr- NonFatalErr- FatalErr- UnsupReq- AuxPwr- TransPend-
		LnkCap:	Port #1, Speed 5GT/s, Width x1, ASPM L0s L1, Exit Latency L0s <2us, L1 <8us
			ClockPM- Surprise- LLActRep- BwNot- ASPMOptComp+
		LnkCtl:	ASPM L1 Enabled; RCB 64 bytes, Disabled- CommClk+
			ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-
		LnkSta:	Speed 5GT/s (ok), Width x1 (ok)
			TrErr- Train- SlotClk+ DLActive- BWMgmt- ABWMgmt-
		DevCap2: Completion Timeout: Range ABCD, TimeoutDis+ NROPrPrP- LTR+
			 10BitTagComp- 10BitTagReq- OBFF Not Supported, ExtFmt+ EETLPPrefix-
			 EmergencyPowerReduction Not Supported, EmergencyPowerReductionInit-
			 FRS- TPHComp- ExtTPHComp-
			 AtomicOpsCap: 32bit- 64bit- 128bitCAS-
		DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis- LTR- OBFF Disabled,
			 AtomicOpsCtl: ReqEn-
		LnkCap2: Supported Link Speeds: 2.5-5GT/s, Crosslink- Retimer- 2Retimers- DRS-
		LnkCtl2: Target Link Speed: 5GT/s, EnterCompliance- SpeedDis-
			 Transmit Margin: Normal Operating Range, EnterModifiedCompliance- ComplianceSOS-
			 Compliance De-emphasis: -6dB
		LnkSta2: Current De-emphasis Level: -3.5dB, EqualizationComplete- EqualizationPhase1-
			 EqualizationPhase2- EqualizationPhase3- LinkEqualizationRequest-
			 Retimer- 2Retimers- CrosslinkRes: unsupported
	Capabilities: [e0] MSI: Enable+ Count=1/32 Maskable+ 64bit+
		Address: 00000000fee00000  Data: 0000
		Masking: fffffffe  Pending: 00000000
	Capabilities: [f8] Power Management version 3
		Flags: PMEClk- DSI+ D1+ D2+ AuxCurrent=0mA PME(D0+,D1+,D2+,D3hot+,D3cold+)
		Status: D0 NoSoftRst+ PME-Enable- DSel=0 DScale=0 PME-
	Capabilities: [100 v1] Vendor Specific Information: ID=1556 Rev=1 Len=008 <?>
	Capabilities: [108 v1] Latency Tolerance Reporting
		Max snoop latency: 0ns
		Max no snoop latency: 0ns
	Capabilities: [110 v1] L1 PM Substates
		L1SubCap: PCI-PM_L1.2+ PCI-PM_L1.1+ ASPM_L1.2+ ASPM_L1.1+ L1_PM_Substates+
			  PortCommonModeRestoreTime=3us PortTPowerOnTime=28us
		L1SubCtl1: PCI-PM_L1.2- PCI-PM_L1.1+ ASPM_L1.2- ASPM_L1.1+
			   T_CommonMode=0us LTR1.2_Threshold=0ns
		L1SubCtl2: T_PwrOn=10us
	Capabilities: [200 v2] Advanced Error Reporting
		UESta:	DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
		UEMsk:	DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
		UESvrt:	DLP+ SDES+ TLP- FCP+ CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP+ ECRC- UnsupReq- ACSViol-
		CESta:	RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr-
		CEMsk:	RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr+
		AERCap:	First Error Pointer: 00, ECRCGenCap- ECRCGenEn- ECRCChkCap- ECRCChkEn-
			MultHdrRecCap- MultHdrRecEn- TLPPfxPres- HdrLogCap-
		HeaderLog: 00000000 00000000 00000000 00000000
	Kernel driver in use: mt7921e
	Kernel modules: mt7921e

Comment 1 The Linux kernel's regression tracker (Thorsten Leemhuis) 2022-04-04 14:00:43 UTC

To clarify: did this machine work fine with earlier kernel series, like 5.16 or 5.15?