[Bug 2171043] Lsusb.txt

apport information ** Attachment added: "Lsusb.txt" https://bugs.launchpad.net/bugs/2171043/+attachment/6010483/+files/Lsusb.txt -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171043 Title: ipu-bridge lists SONY471A twice (mainline + SAUCE): IPU7 probe fails with -EEXIST, imx471 use-after-free oops, suspend hangs Status in linux package in Ubuntu: Incomplete Bug description: Release: Ubuntu 26.04 (resolute) Kernel: linux-image-7.0.0-38-generic 7.0.0-38.38 (also present in linux-oem-26.04 7.0.0-1015.15) Machine: Lenovo ThinkPad X9-15 Gen 1 (21Q6001FZA), BIOS N4CET41W (1.17), Lunar Lake, IPU7 8086:645d, Sony IMX471 sensor (ACPI HID SONY471A) PROBLEM In drivers/media/pci/intel/ipu-bridge.c in 7.0.0-38.38, ipu_supported_sensors[] contains IPU_SENSOR_CONFIG("SONY471A", 1, 200000000) twice: - line 107: from mainline v7.0. It is present in linux_7.0.0.orig.tar.gz. - line 111: added again by the carried patch "UBUNTU: SAUCE: media: ipu-bridge: Support imx471 sensor" (LP: #2107320). ipu_bridge_connect_sensors() handles the second entry, finds the same ACPI device and tries to register software nodes with the same names. intel-ipu7 then fails to probe on every boot: sysfs: cannot create duplicate filename '/kernel/software_nodes/SONY471A-0' kobject: kobject_add_internal failed for SONY471A-0 with -EEXIST, ... intel-ipu7 0000:00:05.0: error -EEXIST: IPU bridge init failed intel-ipu7 0000:00:05.0: probe with driver intel-ipu7 failed with error -17 The error path unregisters the bridge's software nodes, but the imx471 sensor driver (ubuntu/dkms/ipu6/imx471.ko) is probing against those nodes. imx471_check_hwcfg() then uses freed fwnode memory. Every boot logs "refcount_t: addition on 0; use-after-free" warnings. On some boots (3 of 5 here) it oopses inside the deferred-probe worker: BUG: unable to handle page fault for address: 0000000a00000094 Workqueue: events_unbound deferred_probe_work_func RIP: 0010:fwnode_graph_get_next_endpoint+0x42/0xc0 imx471_check_hwcfg+0x68/0x190 [imx471] imx471_probe+0x31/0x4e0 [imx471] i2c_device_probe ... deferred_probe_work_func (One boot showed "BUG: kernel NULL pointer dereference, address: 0000000000000009" at the same RIP.) IMPACT - The webcam never works: the IPU7 device stays unbound. - After the oops, the dead kworker leaves a probe in flight, so wait_for_device_probe() never returns. dpm_prepare() and device_shutdown() both call it, so: * lid-close suspend never completes. The internal panel stays black on lid open, external displays get no signal, and a forced power-off is needed (attachment suspend-hang-journal.txt; the journal ends at "PM: suspend entry (s2idle)" / "Filesystems sync"). * reboot/shutdown can hang at the very end. To users this looks like a display/graphics resume bug, which makes it hard to diagnose. STEPS TO REPRODUCE 1. Boot 7.0.0-38-generic on a machine with a SONY471A sensor (e.g. ThinkPad X9-15 Gen 1). 2. dmesg | grep -E "SONY471A-0|IPU bridge init|refcount_t|BUG:" -> the duplicate-name error and -EEXIST appear every boot; use-after-free warnings or an oops follow. 3. If an oops occurred: close the lid. The machine never comes back from suspend. FIX Drop the duplicate entry (attached 0001-ipu-bridge-drop-duplicate-SONY471A-entry.patch); keep TBE20A0, which mainline doesn't have. The SAUCE patch's SONY471A line has been redundant since mainline added the entry. TESTED - I rebuilt ipu-bridge.ko from the linux_7.0.0-38.38 source package. The unmodified build has the same srcversion as the shipped module (4DB31BE24A1FDC6F27DA3A5), so the source matches. - With only the duplicate line removed: "intel-ipu7 0000:00:05.0: Found supported sensor SONY471A:00", "Connected 1 cameras", "imx471 i2c-SONY471A:00: imx471 probe successfully", "All sensor registration completed". No refcount warnings and no oops across several boots. Lid-close suspend/resume works. The camera works through libcamhal-ipu7x / icamerasrc / v4l2-relayd. - linux-oem-26.04 7.0.0-1015.15: I didn't boot it, but the ipu_supported_sensors[] table in its shipped ipu-bridge.ko (read from the relocations) has the same two consecutive SONY471A entries, so it is affected too. Note: the running system now uses the locally rebuilt ipu-bridge.ko (taint E). The attached logs are from boots of the unmodified stock kernel. # Last journal lines of two boots on 7.0.0-38-generic where the same oops occurred at boot. # Lid close -> suspend never completes / never resumes; machine needed a forced power-off. ## boot 9817a19537db4cc5a9cd69315c633da5 oops at boot: BUG: kernel NULL pointer dereference, address: 0000000000000009 2026-10-15T08:58:43+02:00 systemd-logind[1149]: Suspending... 2026-10-15T08:59:13+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Successfully froze unit 'user.slice'. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Performing sleep operation 'suspend'... 2026-10-15T08:59:13+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T08:59:13+02:00 kernel: Filesystems sync: 0.011 seconds ## boot 8c4e64b1100643058a7f1a25f338741d oops at boot: BUG: unable to handle page fault for address: 000001a400000084 2026-10-15T11:59:47+02:00 systemd-logind[1272]: Suspending... 2026-10-15T11:59:49+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Successfully froze unit 'user.slice'. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Performing sleep operation 'suspend'... 2026-10-15T11:59:49+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T11:59:49+02:00 kernel: Filesystems sync: 0.010 seconds --- ProblemType: Bug ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: david 3662 F.... pipewire david 3681 F.... wireplumber /dev/snd/seq: david 3662 F.... pipewire CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME DistroRelease: Ubuntu 26.04 InstallationDate: Installed on 2026-07-16 (95 days ago) InstallationMedia: Ubuntu 24.04.4 LTS "Noble Numbat" - Release amd64 (20260210) MachineType: LENOVO 21Q6001FZA Package: linux (not installed) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-ghostty ProcFB: 0 xedrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic root=UUID=9b9de093-0e50-47da-9445-062c28533e4d ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 StagingDrivers: intel_ipu7_isys intel_ipu7 Tags: resolute staging Uname: Linux 7.0.0-38-generic x86_64 UpgradeStatus: Upgraded to resolute on 2026-10-10 (9 days ago) UserGroups: N/A _MarkForUpload: True dmi.bios.date: 10/29/2025 dmi.bios.release: 1.17 dmi.bios.vendor: LENOVO dmi.bios.version: N4CET41W (1.17 ) dmi.board.asset.tag: Not Available dmi.board.name: 21Q6001FZA dmi.board.vendor: LENOVO dmi.board.version: SDK0T76576 WIN dmi.chassis.asset.tag: No Asset Information dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: None dmi.ec.firmware.release: 1.12 dmi.modalias: dmi:bvnLENOVO:bvrN4CET41W(1.17):bd10/29/2025:br1.17:efr1.12:svnLENOVO:pn21Q6001FZA:pvrThinkPadX9-15Gen1:rvnLENOVO:rn21Q6001FZA:rvrSDK0T76576WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_21Q6_BU_Think_FM_ThinkPadX9-15Gen1:pfaThinkPadX9-15Gen1: dmi.product.family: ThinkPad X9-15 Gen 1 dmi.product.name: 21Q6001FZA dmi.product.sku: LENOVO_MT_21Q6_BU_Think_FM_ThinkPad X9-15 Gen 1 dmi.product.version: ThinkPad X9-15 Gen 1 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171043/+subscriptions