[BUG] MT7921AU 无线网卡驱动触发内核空指针异常(mt792x_rx_get_wcid)

LittleMio】 在 https://github.com/istoreos/istoreos/issues/2594 发布:

描述

在使用 MT7921AU USB无线网卡时,设备运行一段时间后出现网络中断,并触发内核崩溃。loggerd 日志中关键报错如下:

Wed Aug  6 16:08:21 2025 kern.alert kernel: [99246.746283] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000400
Wed Aug  6 16:08:21 2025 kern.alert kernel: [99246.747068] Mem abort info:
Wed Aug  6 16:08:21 2025 kern.alert kernel: [99246.747317]   ESR = 0x0000000096000004
Wed Aug  6 16:08:21 2025 kern.alert kernel: [99246.747648]   EC = 0x25: DABT (current EL), IL = 32 bits
Wed Aug  6 16:08:21 2025 kern.alert kernel: [99246.748114]   SET = 0, FnV = 0
Wed Aug  6 16:08:21 2025 kern.alert kernel: [99246.748382]   EA = 0, S1PTW = 0
Wed Aug  6 16:08:21 2025 kern.alert kernel: [99246.748658]   FSC = 0x04: level 0 translation fault
Wed Aug  6 16:08:21 2025 kern.alert kernel: [99246.749084] Data abort info:
Wed Aug  6 16:08:21 2025 kern.alert kernel: [99246.749337]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
Wed Aug  6 16:08:21 2025 kern.alert kernel: [99246.749817]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
Wed Aug  6 16:08:21 2025 kern.alert kernel: [99246.750258]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
Wed Aug  6 16:08:21 2025 kern.alert kernel: [99246.750723] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000032ba6000
Wed Aug  6 16:08:21 2025 kern.alert kernel: [99246.751284] [0000000000000400] pgd=0000000000000000, p4d=0000000000000000
Wed Aug  6 16:08:21 2025 kern.emerg kernel: [99246.751882] Internal error: Oops: 0000000096000004 [#1] SMP
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.752372] Modules linked in: rtl8821ae(O) rtl8192se(O) rtl8192de(O) rtl8192d_common(O) rtl8192cu(O) rtl8192c_common(O) rtl_usb(O) rtl_pci(O) qcserial pppoe ppp_async option mt7925u(O) mt7925_common(O) mt7921u(O) mt7921e(O) mt7921_common(O) mt76x0u(O) mt76x0_common(O) l2tp_ppp iscsi_tcp ipw cdc_mbim btcoexist(O) wireguard uvcvideo usb_wwan usb_serial_simple ti_usb_3410_5052 sr9700 snd_usb_audio smsc95xx smsc75xx sierra_net sierra sch_mqprio rtlwifi(O) rtl8xxxu(O) rndis_host qmi_wwan pptp pppox ppp_mppe ppp_generic plusb pl2303 oti6858 nft_fib_inet nf_flow_table_inet mtk_t7xx mt7996e(O) mt792x_usb(O) mt792x_lib(O) mt7915e(O) mt76x02_usb(O) mt76x02_lib(O) mt7663u(O) mt7663_usb_sdio_common(O) mt7615e(O) mt7615_common(O) mt76_usb(O) mt76_connac_lib(O) mt76(O) mos7840 mos7720 mhi_wwan_mbim mhi_wwan_ctrl mct_u232 mcs7830 mac80211(O) libiscsi_tcp libiscsi libchacha20poly1305 keyspan kalmia ipt_REJECT io_edgeport huawei_cdc_ncm garmin_gps ftdi_sio dm9601 cypress_m8 cp210x chacha_neon ch341 cfg80211(O) cdc_subset cdc_ncm
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.752538]  cdc_ether cdc_eem belkin_sa ax88179_178a asix ark3116 aqc111 zstd xt_time xt_tcpudp xt_state xt_recent xt_quota xt_pkttype xt_physdev xt_owner xt_nat xt_multiport xt_mark xt_mac xt_limit xt_helper xt_conntrack xt_connmark xt_connlimit xt_connbytes xt_comment xt_cgroup xt_addrtype xt_TCPMSS xt_REDIRECT xt_MASQUERADE xt_LOG xt_CT xr_usb_serial_common(O) wwan visor videobuf2_v4l2 uvc usbserial usbnet usblp usbhid usbatm ums_usbat ums_sddr55 ums_sddr09 ums_karma ums_jumpshot ums_isd200 ums_freecom ums_datafab ums_cypress ums_alauda udl ts_fsm ts_bm snd_usbmidi_lib smsc slhc scsi_transport_iscsi sch_mqprio_lib sch_cake rtl8150 rockchip_saradc rk_vcodec(O) rga3(O) r8152 qrtr_tun qrtr_mhi qrtr poly1305_neon pegasus nft_tproxy nft_socket nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject_bridge nft_reject nft_redir nft_quota nft_numgen nft_nat nft_meta_bridge nft_masq nft_log nft_limit nft_hash nft_fwd_netdev nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_dup_netdev nft_ct nft_compat nft_chain_nat
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.760466]  nf_tproxy_ipv6 nf_tproxy_ipv4 nf_tables nf_socket_ipv6 nf_socket_ipv4 nf_reject_ipv4 nf_nat_tftp nf_nat_snmp_basic nf_nat_sip nf_nat_pptp nf_nat_irc nf_nat_h323 nf_nat_ftp nf_nat_amanda nf_log_syslog nf_flow_table nf_dup_netdev nf_conntrack_tftp nf_conntrack_snmp nf_conntrack_sip nf_conntrack_sane nf_conntrack_pptp nf_conntrack_netlink nf_conntrack_netbios_ns nf_conntrack_irc nf_conntrack_h323 nf_conntrack_ftp nf_conntrack_broadcast nf_conntrack_bridge ts_kmp nf_conntrack_amanda nf_conncount mhi_pci_generic mhi_net mhi macvlan lzo_rle lzo libcurve25519_generic libchacha lan78xx kaweth iptable_nat iptable_mangle iptable_filter ipheth ip_tables hso hid_generic hid_cp2112 ezusb drm_shmem_helper dmx_usb(O) crc_ccitt compat(O) cm109 cls_flower cdc_wdm cdc_acm br_netfilter ax88796b bifrost_kbase(O) fuse ntfs3 rockchipdrm dw_hdmi drm_dma_helper drm_display_helper dw_hdmi_cec cec display_connector drm_kms_helper sch_teql sch_sfq sch_multiq sch_gred sch_fq sch_ets sch_codel em_text em_nbyte em_meta em_cmp
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.768405]  act_skbmod act_simple act_pedit act_csum em_ipset cls_bpf act_bpf act_ctinfo act_connmark sch_tbf sch_ingress sch_htb sch_hfsc em_u32 cls_u32 cls_route cls_matchall cls_fw cls_flow cls_basic act_skbedit act_mirred act_gact videobuf2_vmalloc videobuf2_memops videobuf2_common sg hid videodev mc pwm_fan drivetemp industrialio_triggered_buffer kfifo_buf usb_f_acm u_serial usb_f_ncm usb_f_mass_storage usb_f_hid usb_f_ecm u_ether libcomposite trelay(O) ppdev parport ledtrig_pattern ledtrig_activity xt_set ip_set_list_set ip_set_hash_netportnet ip_set_hash_netport ip_set_hash_netnet ip_set_hash_netiface ip_set_hash_net ip_set_hash_mac ip_set_hash_ipportnet ip_set_hash_ipportip ip_set_hash_ipport ip_set_hash_ipmark ip_set_hash_ipmac ip_set_hash_ip ip_set_bitmap_port ip_set_bitmap_ipmac ip_set_bitmap_ip ip_set nfnetlink st sr_mod ip6table_nat nf_nat nf_conntrack nf_defrag_ipv4 ip6t_NPT ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 nfsv4 nfsv3 ksmbd nfsd nfs msdos bonding tls
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.776283]  ip6_gre ip_gre gre r8169 e1000e e1000 e100 ifb dummy nat46(O) nf_defrag_ipv6 l2tp_ip6 l2tp_ip l2tp_eth sit sctp l2tp_netlink l2tp_core ipcomp6 xfrm6_tunnel esp6 ah6 xfrm4_tunnel ipcomp esp4 ah4 ipip ip6_tunnel xsk_diag netlink_diag tunnel6 tunnel4 ip_tunnel udp_diag tcp_diag raw_diag inet_diag rpcsec_gss_krb5 auth_rpcgss dm_raid veth tun snd_rawmidi snd_seq_device snd_pcm_oss snd_mixer_oss snd_hwdep snd_compress snd_pcm snd_timer snd soundcore nbd xfrm_user xfrm_ipcomp af_key xfrm_algo udf crc_itu_t lockd sunrpc grace minix isofs hfsplus hfs cdrom cramfs cifs oid_registry cifs_md4 cifs_arc4 asn1_decoder binfmt_misc autofs4 dns_resolver br2684 atm aoe multipath cachefiles fscache raid456 async_raid6_recov async_pq async_xor async_memcpy async_tx raid10 raid1 raid0 linear netfs md_mod nls_utf8 nls_cp936 nls_cp437 zram zsmalloc vxlan udp_tunnel ip6_udp_tunnel xxhash_generic crypto_user algif_skcipher algif_rng algif_hash algif_aead af_alg sha512_generic sha512_arm64 sha256_arm64 sha1_ce sha1_generic seqiv
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.784222]  sha3_generic jitterentropy_rng drbg md5 kpp hmac echainiv geniv rng ecb des_generic libdes deflate cts cmac cbc blake2b_generic authencesn authenc arc4 crypto_acompress sysimgblt sysfillrect syscopyarea fb_sys_fops fb font fb_io_fops drm drm_panel_orientation_quirks uas rtl8367b swconfig rtl8366_smi ahci_dwc ahci ahci_platform libahci_platform libahci libata igc igb i2c_algo_bit gpio_button_hotplug(O) xfs vfat fat reiserfs jfs nls_ucs2_utils exfat btrfs xor zstd_decompress zstd_compress zstd_common xor_neon raid6_pq lzo_decompress lzo_compress dm_mirror dm_region_hash dm_log dm_crypt button_hotplug(O) udc_core microchip tpm encrypted_keys trusted [last unloaded: rknpu(O)]
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.797356] CPU: 3 PID: 1660 Comm: mt76-usb-rx phy Tainted: G           O       6.6.93 #0
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.798073] Hardware name: FriendlyElec NanoPi R5S LTS (DT)
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.798561] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.799172] pc : mt792x_rx_get_wcid+0x3c/0xdc [mt792x_lib]
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.799700] lr : mt7921_queue_rx_skb+0x140/0x7e8 [mt7921_common]
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.800237] sp : ffff800083353cf0
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.800528] x29: ffff800083353cf0 x28: 0000000000000000 x27: 0000000000000000
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.801155] x26: 0000000000006740 x25: 000000000000a112 x24: 0000000011ab05e4
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.801781] x23: ffff000008cfd000 x22: 0000000080007801 x21: ffff000007722000
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.802407] x20: ffff000023dbf328 x19: ffff000023dbf300 x18: 0000000000000000
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.803032] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000070
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.803657] x14: 0000000000000080 x13: 0000000000000000 x12: 0000000000000001
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.804283] x11: 0000000000000001 x10: 0000000000000950 x9 : 0000000000000000
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.804908] x8 : ffff000023dbf3b8 x7 : 0000000000000000 x6 : 000000000000003f
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.805533] x5 : 0000000000000040 x4 : ffff80007ba06c58 x3 : 00000000000046a0
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.806159] x2 : 0000000000000000 x1 : 000000000000000a x0 : 0000000000000000
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.806785] Call trace:
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.807002]  mt792x_rx_get_wcid+0x3c/0xdc [mt792x_lib]
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.807467]  mt76u_alloc_queues+0x6f4/0xac0 [mt76_usb]
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.807933]  __mt76_worker_fn+0x90/0xe0 [mt76]
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.808343]  kthread+0xe0/0xe4
Wed Aug  6 16:08:21 2025 kern.notice kernel: [99246.808618]  ret_from_fork+0x10/0x20
Wed Aug  6 16:08:21 2025 kern.emerg kernel: [99246.808939] Code: 54000101 79417801 360800e1 f941bc00 (f9420000)
Wed Aug  6 16:08:21 2025 kern.warn kernel: [99246.809473] ---[ end trace 0000000000000000 ]---

环境

  • 设备:FriendlyElec NanoPi R5S LTS
  • 网卡:MediaTek MT7921AU,ID 0e8d:7961
  • 固件版本 iStoreOS 24.10.2 2025080110 / LuCI openwrt-24.10 branch 25.184.15956~ab493ea

复现步骤

  1. 插入 MT7921AU USB 网卡,正常连接网络
  2. 系统运行几小时至几天后
  3. 网络中断、设备掉线
  4. 查看 loggerd 出现 kernel NULL pointer 异常

其他