VOXL2 BT5.0 Support?
-
Hi all, we’re seeing a reproducible BLE scan crash on VOXL2 / Starling 2 with SDK v1.8.06 when BLE 5 extended advertising is present.
QRB5165 code path: https://gitlab.com/voxl-public/system-image-build/qrb5165-kernel/-/blob/v1.8.06/net/bluetooth/hci_event.c#L5385
From device captures (see dmesg segments describe below, I don't forum privileges to post the logs), we’re seeing LE Extended Advertising Report (0x0d) events with Num reports up to 6, followed by a kernel NULL deref in the Bluetooth RX path (hci0 hci_rx_work -> process_adv_report -> hci_bdaddr_list_lookup).
This looks consistent with the extended-adv bounds-check issue in hci_le_ext_adv_report_evt() that upstream now guards here:
https://github.com/torvalds/linux/blob/master/net/bluetooth/hci_event.cKey lines from dmesg:
- Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
- Workqueue: hci0 hci_rx_work
- pc : hci_bdaddr_list_lookup+0x24/0x60
- lr : process_adv_report+0x154/0x408
- call trace includes hci_le_meta_evt and hci_event_packet
- Bluetooth: Unknown advertising packet type: 0x100
- Bluetooth: Unknown advertising packet type: 0x4cff
Have you seen this on QRB5165 / VOXL2 before, and is there already a downstream fix or recommended workaround / SDK version for BLE 5 extended advertising? I pulled in the guards from the latest kernel, testing today.
Related post:
https://forum.modalai.com/topic/5181/bluetooth-integration-on-the-voxl2
