linux-kernel - Re: wlwifi AX201: WARN_ON in iwl_mvm_mld_mac_ctxt_cmd_common repeated UMAC FW crashes on 6.16-rc2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e179da27-feb6-36fe-0a3b-bc24fb00b62d@google.com>
Date: Sun, 22 Jun 2025 17:00:04 -0700 (PDT)
From: Hugh Dickins <hughd@...gle.com>
To: Damian Tometzki <damian@...cv-rocks.de>
cc: Linus Torvalds <torvalds@...ux-foundation.org>, 
    miriam.rachel.korenblit@...el.com, linux-wireless@...r.kernel.org, 
    linux-kernel@...r.kernel.org
Subject: Re: wlwifi AX201: WARN_ON in iwl_mvm_mld_mac_ctxt_cmd_common repeated
 UMAC FW crashes on 6.16-rc2

On Sun, 22 Jun 2025, Damian Tometzki wrote:
> On Sun, Jun 22, 2025 at 6:30 PM Damian Tometzki <damian@...cv-rocks.de> wrote:
> >
> > Hi Miri,
> > Hi all,
> >
> > with v6.16-rc2 I consistently hit a Wi-Fi firmware crash on a
> > Lenovo ThinkPad X1 Carbon Gen 9.
> >
> > Hardware / FW
> > -------------
> >  * NIC  : Intel Wi-Fi 6 AX201 160 MHz (PCI ID a0f0:0070, rev 0x351)
> >  * FW   : 77.864baa2e.0 QuZ-a0-hr-b0-77.ucode (auto-loaded)
> >  * BIOS : N32ET96W (1.72)
> >  * Platform: 20XWCTO1WW
> >
> > Kernel: 6.16.0-rc2 #440 PREEMPT(lazy)
> >
> > Symptoms
> > --------
> > Immediately after NetworkManager (or plain `ip link set wlp0s20f3 up`)
> > the driver warns:
> >
> >     WARNING at drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c:37
> >     iwl_mvm_mld_mac_ctxt_cmd_common+0x175/0x1d0
> >
> > The firmware then aborts:
> >
> >     FW error in SYNC CMD MAC_CONFIG_CMD
> >     NMI_INTERRUPT_UMAC_FATAL
> >     ADVANCED_SYSASSERT 0x20103126
> >     Microcode SW error detected. Restarting 0x0.
> >
> > The cycle repeats every few seconds; the interface never becomes usable.
> > Full dmesg attached.
> >
> > --
> > VG
> > Demian Tometzki
> 
> Hi together,
> 
> I identified commit 83f3ac2848b46e3e5af5d06b5f176c as the cause of the issue.
> After reverting it, the system is working again.
> 
> Best regards
> Damian

I have a similar Lenovo X1 Carbon Gen 9: saw no problem on rc1 or rc2,
but vey much this problem on today's 6.16-rc3.

Patch from Miri's reply (attachment without context so I'm replying
to this not that) inlined below, works nicely for me: thank you.
I've removed Change-Id and Organization tags.

Hugh

From: Miri Korenblit <miriam.rachel.korenblit@...el.com>
Date: Sun, 22 Jun 2025 23:42:04 +0300
Subject: [PATCH] wifi: iwlwifi: mvm: assume '1' as the default mac_config_cmd
 version

Unfortunately, FWs of some devices don't have the version of the
iwl_mac_config_cmd defined in the TLVs. We send 0 as the 'def argument
to  iwl_fw_lookup_cmd_ver, so for such FWs, the return value will be 0,
leading to a warning, and to not sending the command.

Fix this by assuming that the default version is 1.

Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@...el.com>
---
 drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c
index 3c255ae916c8..48ab6a2a98cc 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c
@@ -32,7 +32,7 @@ static void iwl_mvm_mld_mac_ctxt_cmd_common(struct iwl_mvm *mvm,
 	unsigned int link_id;
 	int cmd_ver = iwl_fw_lookup_cmd_ver(mvm->fw,
 					    WIDE_ID(MAC_CONF_GROUP,
-						    MAC_CONFIG_CMD), 0);
+						    MAC_CONFIG_CMD), 1);
 
 	if (WARN_ON(cmd_ver < 1 || cmd_ver > 3))
 		return;
-- 
2.34.1