[Bug 2171043] Re: ipu-bridge lists SONY471A twice (mainline + SAUCE): IPU7 probe fails with -EEXIST, imx471 use-after-free oops, suspend hangs

Thank you very much for reporting this issue. Could you please provide more information? Please boot into the Ubuntu kernel and run the following command in a terminal to collect debugging information and attach it to this report. $ sudo apport-collect 2171043 ** Changed in: linux (Ubuntu) Status: New => Incomplete -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171043 Title: ipu-bridge lists SONY471A twice (mainline + SAUCE): IPU7 probe fails with -EEXIST, imx471 use-after-free oops, suspend hangs Status in linux package in Ubuntu: Incomplete Bug description: Release: Ubuntu 26.04 (resolute) Kernel: linux-image-7.0.0-38-generic 7.0.0-38.38 (also present in linux-oem-26.04 7.0.0-1015.15) Machine: Lenovo ThinkPad X9-15 Gen 1 (21Q6001FZA), BIOS N4CET41W (1.17), Lunar Lake, IPU7 8086:645d, Sony IMX471 sensor (ACPI HID SONY471A) PROBLEM In drivers/media/pci/intel/ipu-bridge.c in 7.0.0-38.38, ipu_supported_sensors[] contains IPU_SENSOR_CONFIG("SONY471A", 1, 200000000) twice: - line 107: from mainline v7.0. It is present in linux_7.0.0.orig.tar.gz. - line 111: added again by the carried patch "UBUNTU: SAUCE: media: ipu-bridge: Support imx471 sensor" (LP: #2107320). ipu_bridge_connect_sensors() handles the second entry, finds the same ACPI device and tries to register software nodes with the same names. intel-ipu7 then fails to probe on every boot: sysfs: cannot create duplicate filename '/kernel/software_nodes/SONY471A-0' kobject: kobject_add_internal failed for SONY471A-0 with -EEXIST, ... intel-ipu7 0000:00:05.0: error -EEXIST: IPU bridge init failed intel-ipu7 0000:00:05.0: probe with driver intel-ipu7 failed with error -17 The error path unregisters the bridge's software nodes, but the imx471 sensor driver (ubuntu/dkms/ipu6/imx471.ko) is probing against those nodes. imx471_check_hwcfg() then uses freed fwnode memory. Every boot logs "refcount_t: addition on 0; use-after-free" warnings. On some boots (3 of 5 here) it oopses inside the deferred-probe worker: BUG: unable to handle page fault for address: 0000000a00000094 Workqueue: events_unbound deferred_probe_work_func RIP: 0010:fwnode_graph_get_next_endpoint+0x42/0xc0 imx471_check_hwcfg+0x68/0x190 [imx471] imx471_probe+0x31/0x4e0 [imx471] i2c_device_probe ... deferred_probe_work_func (One boot showed "BUG: kernel NULL pointer dereference, address: 0000000000000009" at the same RIP.) IMPACT - The webcam never works: the IPU7 device stays unbound. - After the oops, the dead kworker leaves a probe in flight, so wait_for_device_probe() never returns. dpm_prepare() and device_shutdown() both call it, so: * lid-close suspend never completes. The internal panel stays black on lid open, external displays get no signal, and a forced power-off is needed (attachment suspend-hang-journal.txt; the journal ends at "PM: suspend entry (s2idle)" / "Filesystems sync"). * reboot/shutdown can hang at the very end. To users this looks like a display/graphics resume bug, which makes it hard to diagnose. STEPS TO REPRODUCE 1. Boot 7.0.0-38-generic on a machine with a SONY471A sensor (e.g. ThinkPad X9-15 Gen 1). 2. dmesg | grep -E "SONY471A-0|IPU bridge init|refcount_t|BUG:" -> the duplicate-name error and -EEXIST appear every boot; use-after-free warnings or an oops follow. 3. If an oops occurred: close the lid. The machine never comes back from suspend. FIX Drop the duplicate entry (attached 0001-ipu-bridge-drop-duplicate-SONY471A-entry.patch); keep TBE20A0, which mainline doesn't have. The SAUCE patch's SONY471A line has been redundant since mainline added the entry. TESTED - I rebuilt ipu-bridge.ko from the linux_7.0.0-38.38 source package. The unmodified build has the same srcversion as the shipped module (4DB31BE24A1FDC6F27DA3A5), so the source matches. - With only the duplicate line removed: "intel-ipu7 0000:00:05.0: Found supported sensor SONY471A:00", "Connected 1 cameras", "imx471 i2c-SONY471A:00: imx471 probe successfully", "All sensor registration completed". No refcount warnings and no oops across several boots. Lid-close suspend/resume works. The camera works through libcamhal-ipu7x / icamerasrc / v4l2-relayd. - linux-oem-26.04 7.0.0-1015.15: I didn't boot it, but the ipu_supported_sensors[] table in its shipped ipu-bridge.ko (read from the relocations) has the same two consecutive SONY471A entries, so it is affected too. Note: the running system now uses the locally rebuilt ipu-bridge.ko (taint E). The attached logs are from boots of the unmodified stock kernel. # Last journal lines of two boots on 7.0.0-38-generic where the same oops occurred at boot. # Lid close -> suspend never completes / never resumes; machine needed a forced power-off. ## boot 9817a19537db4cc5a9cd69315c633da5 oops at boot: BUG: kernel NULL pointer dereference, address: 0000000000000009 2026-10-15T08:58:43+02:00 systemd-logind[1149]: Suspending... 2026-10-15T08:59:13+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Successfully froze unit 'user.slice'. 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Performing sleep operation 'suspend'... 2026-10-15T08:59:13+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T08:59:13+02:00 kernel: Filesystems sync: 0.011 seconds ## boot 8c4e64b1100643058a7f1a25f338741d oops at boot: BUG: unable to handle page fault for address: 000001a400000084 2026-10-15T11:59:47+02:00 systemd-logind[1272]: Suspending... 2026-10-15T11:59:49+02:00 systemd[1]: Reached target sleep.target - Sleep. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Successfully froze unit 'user.slice'. 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Performing sleep operation 'suspend'... 2026-10-15T11:59:49+02:00 kernel: PM: suspend entry (s2idle) 2026-10-15T11:59:49+02:00 kernel: Filesystems sync: 0.010 seconds To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171043/+subscriptions