apport information
** Tags added: apport-collected resolute staging
** Description changed:
Release: Ubuntu 26.04 (resolute)
Kernel: linux-image-7.0.0-38-generic 7.0.0-38.38 (also present in
linux-oem-26.04 7.0.0-1015.15)
Machine: Lenovo ThinkPad X9-15 Gen 1 (21Q6001FZA), BIOS N4CET41W (1.17),
Lunar Lake,
IPU7 8086:645d, Sony IMX471 sensor (ACPI HID SONY471A)
PROBLEM
In drivers/media/pci/intel/ipu-bridge.c in 7.0.0-38.38,
ipu_supported_sensors[] contains
IPU_SENSOR_CONFIG("SONY471A", 1, 200000000) twice:
- line 107: from mainline v7.0. It is present in linux_7.0.0.orig.tar.gz.
- line 111: added again by the carried patch
"UBUNTU: SAUCE: media: ipu-bridge: Support imx471 sensor" (LP: #2107320).
ipu_bridge_connect_sensors() handles the second entry, finds the same ACPI
device and tries
to register software nodes with the same names. intel-ipu7 then fails to
probe on every boot:
sysfs: cannot create duplicate filename '/kernel/software_nodes/SONY471A-0'
kobject: kobject_add_internal failed for SONY471A-0 with -EEXIST, ...
intel-ipu7 0000:00:05.0: error -EEXIST: IPU bridge init failed
intel-ipu7 0000:00:05.0: probe with driver intel-ipu7 failed with error -17
The error path unregisters the bridge's software nodes, but the imx471 sensor
driver
(ubuntu/dkms/ipu6/imx471.ko) is probing against those nodes.
imx471_check_hwcfg() then uses
freed fwnode memory. Every boot logs "refcount_t: addition on 0;
use-after-free" warnings. On
some boots (3 of 5 here) it oopses inside the deferred-probe worker:
BUG: unable to handle page fault for address: 0000000a00000094
Workqueue: events_unbound deferred_probe_work_func
RIP: 0010:fwnode_graph_get_next_endpoint+0x42/0xc0
imx471_check_hwcfg+0x68/0x190 [imx471]
imx471_probe+0x31/0x4e0 [imx471]
i2c_device_probe ... deferred_probe_work_func
(One boot showed "BUG: kernel NULL pointer dereference, address:
0000000000000009" at the same RIP.)
IMPACT
- The webcam never works: the IPU7 device stays unbound.
- After the oops, the dead kworker leaves a probe in flight, so
wait_for_device_probe() never
returns. dpm_prepare() and device_shutdown() both call it, so:
* lid-close suspend never completes. The internal panel stays black on lid
open, external
displays get no signal, and a forced power-off is needed (attachment
suspend-hang-journal.txt;
the journal ends at "PM: suspend entry (s2idle)" / "Filesystems sync").
* reboot/shutdown can hang at the very end.
To users this looks like a display/graphics resume bug, which makes it hard
to diagnose.
STEPS TO REPRODUCE
1. Boot 7.0.0-38-generic on a machine with a SONY471A sensor (e.g. ThinkPad
X9-15 Gen 1).
2. dmesg | grep -E "SONY471A-0|IPU bridge init|refcount_t|BUG:"
-> the duplicate-name error and -EEXIST appear every boot; use-after-free
warnings or an oops follow.
3. If an oops occurred: close the lid. The machine never comes back from
suspend.
FIX
Drop the duplicate entry (attached
0001-ipu-bridge-drop-duplicate-SONY471A-entry.patch); keep
TBE20A0, which mainline doesn't have. The SAUCE patch's SONY471A line has
been redundant
since mainline added the entry.
TESTED
- I rebuilt ipu-bridge.ko from the linux_7.0.0-38.38 source package. The
unmodified build has the
same srcversion as the shipped module (4DB31BE24A1FDC6F27DA3A5), so the
source matches.
- With only the duplicate line removed:
"intel-ipu7 0000:00:05.0: Found supported sensor SONY471A:00", "Connected 1
cameras",
"imx471 i2c-SONY471A:00: imx471 probe successfully", "All sensor
registration completed".
No refcount warnings and no oops across several boots. Lid-close
suspend/resume works.
The camera works through libcamhal-ipu7x / icamerasrc / v4l2-relayd.
- linux-oem-26.04 7.0.0-1015.15: I didn't boot it, but the
ipu_supported_sensors[] table in its
shipped ipu-bridge.ko (read from the relocations) has the same two
consecutive SONY471A
entries, so it is affected too.
Note: the running system now uses the locally rebuilt ipu-bridge.ko (taint
E). The attached
logs are from boots of the unmodified stock kernel.
# Last journal lines of two boots on 7.0.0-38-generic where the same oops
occurred at boot.
# Lid close -> suspend never completes / never resumes; machine needed a
forced power-off.
## boot 9817a19537db4cc5a9cd69315c633da5
oops at boot: BUG: kernel NULL pointer dereference, address: 0000000000000009
2026-10-15T08:58:43+02:00 systemd-logind[1149]: Suspending...
2026-10-15T08:59:13+02:00 systemd[1]: Reached target sleep.target - Sleep.
2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Successfully froze unit
'user.slice'.
2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Performing sleep operation
'suspend'...
2026-10-15T08:59:13+02:00 kernel: PM: suspend entry (s2idle)
2026-10-15T08:59:13+02:00 kernel: Filesystems sync: 0.011 seconds
## boot 8c4e64b1100643058a7f1a25f338741d
oops at boot: BUG: unable to handle page fault for address: 000001a400000084
2026-10-15T11:59:47+02:00 systemd-logind[1272]: Suspending...
2026-10-15T11:59:49+02:00 systemd[1]: Reached target sleep.target - Sleep.
2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Successfully froze unit
'user.slice'.
2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Performing sleep operation
'suspend'...
2026-10-15T11:59:49+02:00 kernel: PM: suspend entry (s2idle)
2026-10-15T11:59:49+02:00 kernel: Filesystems sync: 0.010 seconds
+ ---
+ ProblemType: Bug
+ ApportVersion: 2.34.1-0ubuntu0.1
+ Architecture: amd64
+ AudioDevicesInUse:
+ USER PID ACCESS COMMAND
+ /dev/snd/controlC0: david 3662 F.... pipewire
+ david 3681 F.... wireplumber
+ /dev/snd/seq: david 3662 F.... pipewire
+ CasperMD5CheckResult: unknown
+ CurrentDesktop: ubuntu:GNOME
+ DistroRelease: Ubuntu 26.04
+ InstallationDate: Installed on 2026-07-16 (95 days ago)
+ InstallationMedia: Ubuntu 24.04.4 LTS "Noble Numbat" - Release amd64
(20260210)
+ MachineType: LENOVO 21Q6001FZA
+ Package: linux (not installed)
+ ProcEnviron:
+ LANG=en_US.UTF-8
+ PATH=(custom, no user)
+ SHELL=/bin/bash
+ TERM=xterm-ghostty
+ ProcFB: 0 xedrmfb
+ ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic
root=UUID=9b9de093-0e50-47da-9445-062c28533e4d ro quiet splash
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
+ ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14
+ StagingDrivers: intel_ipu7_isys intel_ipu7
+ Tags: resolute staging
+ Uname: Linux 7.0.0-38-generic x86_64
+ UpgradeStatus: Upgraded to resolute on 2026-10-10 (9 days ago)
+ UserGroups: N/A
+ _MarkForUpload: True
+ dmi.bios.date: 10/29/2025
+ dmi.bios.release: 1.17
+ dmi.bios.vendor: LENOVO
+ dmi.bios.version: N4CET41W (1.17 )
+ dmi.board.asset.tag: Not Available
+ dmi.board.name: 21Q6001FZA
+ dmi.board.vendor: LENOVO
+ dmi.board.version: SDK0T76576 WIN
+ dmi.chassis.asset.tag: No Asset Information
+ dmi.chassis.type: 10
+ dmi.chassis.vendor: LENOVO
+ dmi.chassis.version: None
+ dmi.ec.firmware.release: 1.12
+ dmi.modalias:
dmi:bvnLENOVO:bvrN4CET41W(1.17):bd10/29/2025:br1.17:efr1.12:svnLENOVO:pn21Q6001FZA:pvrThinkPadX9-15Gen1:rvnLENOVO:rn21Q6001FZA:rvrSDK0T76576WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_21Q6_BU_Think_FM_ThinkPadX9-15Gen1:pfaThinkPadX9-15Gen1:
+ dmi.product.family: ThinkPad X9-15 Gen 1
+ dmi.product.name: 21Q6001FZA
+ dmi.product.sku: LENOVO_MT_21Q6_BU_Think_FM_ThinkPad X9-15 Gen 1
+ dmi.product.version: ThinkPad X9-15 Gen 1
+ dmi.sys.vendor: LENOVO
** Attachment added: "AlsaInfo.txt"
https://bugs.launchpad.net/bugs/2171043/+attachment/6010476/+files/AlsaInfo.txt
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171043
Title:
ipu-bridge lists SONY471A twice (mainline + SAUCE): IPU7 probe fails
with -EEXIST, imx471 use-after-free oops, suspend hangs
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171043/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
