Kernel oops in hid_wiimote driver after pairing/disconnecting Wii U Pro Controller

[chithanh]

Distro: Fedora Linux Asahi Remix 40 (KDE Plasma)
Kernel: 6.11.6-401.asahi.fc40.aarch64+16k

When pairing a Wii U Pro controller via bluetooth, the controller will not work and a kernel oops is recorded when trying to disconnect it. The GUI will be partially unresponsive afterwards. Subsequent attempts to reconnect the controller will fail even after reboot, until it is removed from Bluetooth devices and paired again.

The same controller works without issue on a Raspberry Pi 400 (BCM43456) running Batocera arm64.

[ 1342.600969] Unable to handle kernel paging request at virtual address ffffafd575088008
[ 1342.600985] Mem abort info:
[ 1342.600989]   ESR = 0x0000000096000005
[ 1342.600997]   EC = 0x25: DABT (current EL), IL = 32 bits
[ 1342.601004]   SET = 0, FnV = 0
[ 1342.601010]   EA = 0, S1PTW = 0
[ 1342.601015]   FSC = 0x05: level 1 translation fault
[ 1342.601021] Data abort info:
[ 1342.601025]   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
[ 1342.601031]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[ 1342.601036]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[ 1342.601044] swapper pgtable: 16k pages, 48-bit VAs, pgdp=0000000bd21bc000
[ 1342.601051] [ffffafd575088008] pgd=1000000bd3df8003, p4d=1000000bd3df8003, pud=0000000000000000
[ 1342.601071] Internal error: Oops: 0000000096000005 [#1] SMP
[ 1342.601081] Modules linked in: hid_wiimote ff_memless uhid rfcomm snd_seq_dummy snd_hrtimer snd_seq snd_seq_device r8153_ecm cdc_ether usbnet uinput r8152 mii nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables bnep qrtr brcmfmac_wcc sunrpc uas usb_storage onboard_usb_dev brcmfmac brcmutil cfg80211 hci_bcm4377 bluetooth rfkill appledrm snd_soc_macaudio macsmc_hid snd_soc_cs42l83_i2c apple_z2 apple_isp ofpart snd_soc_cs42l42 snd_soc_apple_mca snd_soc_tas2770 spi_nor videobuf2_dma_sg mtd videobuf2_memops snd_soc_core apple_dcp videobuf2_v4l2 videodev snd_compress ac97_bus snd_pcm_dmaengine mux_core videobuf2_common panel_summit mc apple_soc_cpufreq leds_pwm joydev dm_multipath loop nfnetlink zram hid_apple spi_hid_apple_of spi_hid_apple nvmem_spmi_mfd tps6598x rtc_macsmc gpio_macsmc macsmc_hwmon macsmc_reboot macsmc_power crct10dif_ce
[ 1342.601324]  polyval_ce simple_mfd_spmi polyval_generic ghash_ce snd_pcm sha3_ce sha512_ce dwc3 phy_apple_atc macsmc_rtkit ulpi macsmc typec sha512_arm64 udc_core nvmem_apple_efuses snd_timer asahi snd apple_admac pinctrl_apple_gpio soundcore spmi_apple_controller spi_apple apple_wdt clk_apple_nco adpdrm pwm_apple apple_dart drm_dma_helper i2c_pasemi_platform i2c_pasemi_core xhci_plat_hcd vfat fat nvme_apple apple_sart nvme_core nvme_auth scsi_dh_rdac scsi_dh_emc scsi_dh_alua fuse i2c_dev
[ 1342.601451] CPU: 3 UID: 0 PID: 351 Comm: kworker/3:2 Tainted: G S                 6.11.6-401.asahi.fc40.aarch64+16k #1
[ 1342.601465] Tainted: [S]=CPU_OUT_OF_SPEC
[ 1342.601470] Hardware name: Apple MacBook Pro (13-inch, M1, 2020) (DT)
[ 1342.601476] Workqueue: events wiimote_queue_worker [hid_wiimote]
[ 1342.601512] pstate: 81400009 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
[ 1342.601523] pc : __srcu_read_lock+0x48/0x98
[ 1342.601542] lr : dispatch_hid_bpf_output_report+0x70/0x118
[ 1342.601561] sp : ffff800081187c80
[ 1342.601566] x29: ffff800081187c80 x28: ffff7db2571ae000 x27: 0000000000000002
[ 1342.601580] x26: ffff7db2f1180268 x25: 0000000000080128 x24: 0000000000004008
[ 1342.601592] x23: ffff7db2571afe40 x22: 0000000000000000 x21: ffff7db2571afe10
[ 1342.601604] x20: ffff7db2571ae000 x19: 0000000000000001 x18: 0000000000000000
[ 1342.601616] x17: 0000000000000000 x16: ffffcde027a51f98 x15: 63663a63305f7972
[ 1342.601628] x14: 0000000000000001 x13: 0000000000000030 x12: 0101010101010101
[ 1342.601640] x11: 7f7f7f7f7f7f7f7f x10: 0000000000000000 x9 : ffffcde027a4c888
[ 1342.601653] x8 : 0000000000000000 x7 : 0000000000001e10 x6 : 0000000000001e40
[ 1342.601664] x5 : ffff7db1db3bb600 x4 : 0000000000000000 x3 : 0000000000000000
[ 1342.601676] x2 : 0000000000000001 x1 : 0000000000000008 x0 : ffffafd575088008
[ 1342.601688] Call trace:
[ 1342.601693]  __srcu_read_lock+0x48/0x98
[ 1342.601705]  dispatch_hid_bpf_output_report+0x70/0x118
[ 1342.601719]  hid_hw_output_report+0x60/0xd0
[ 1342.601730]  wiimote_queue_worker+0x100/0x1a8 [hid_wiimote]
[ 1342.601748]  process_one_work+0x180/0x420
[ 1342.601765]  worker_thread+0x25c/0x380
[ 1342.601778]  kthread+0xf4/0x110
[ 1342.601790]  ret_from_fork+0x10/0x20
[ 1342.601808] Code: d53cd040 8b020021 d2800022 8b000020 (f822001f) 
[ 1342.601817] ---[ end trace 0000000000000000 ]---
[ 1342.601844] note: kworker/3:2[351] exited with preempt_count 1
[ 1370.418253] net_ratelimit: 26 callbacks suppressed

asahi-diagnose-20241113-113910.txt
dmesg.txt