Public bug reported:
Release: Ubuntu 26.04 (resolute)
Kernel: linux-image-7.0.0-38-generic 7.0.0-38.38 (also present in
linux-oem-26.04 7.0.0-1015.15)
Machine: Lenovo ThinkPad X9-15 Gen 1 (21Q6001FZA), BIOS N4CET41W (1.17), Lunar
Lake,
IPU7 8086:645d, Sony IMX471 sensor (ACPI HID SONY471A)
PROBLEM
In drivers/media/pci/intel/ipu-bridge.c in 7.0.0-38.38, ipu_supported_sensors[]
contains
IPU_SENSOR_CONFIG("SONY471A", 1, 200000000) twice:
- line 107: from mainline v7.0. It is present in linux_7.0.0.orig.tar.gz.
- line 111: added again by the carried patch
"UBUNTU: SAUCE: media: ipu-bridge: Support imx471 sensor" (LP: #2107320).
ipu_bridge_connect_sensors() handles the second entry, finds the same ACPI
device and tries
to register software nodes with the same names. intel-ipu7 then fails to probe
on every boot:
sysfs: cannot create duplicate filename '/kernel/software_nodes/SONY471A-0'
kobject: kobject_add_internal failed for SONY471A-0 with -EEXIST, ...
intel-ipu7 0000:00:05.0: error -EEXIST: IPU bridge init failed
intel-ipu7 0000:00:05.0: probe with driver intel-ipu7 failed with error -17
The error path unregisters the bridge's software nodes, but the imx471 sensor
driver
(ubuntu/dkms/ipu6/imx471.ko) is probing against those nodes.
imx471_check_hwcfg() then uses
freed fwnode memory. Every boot logs "refcount_t: addition on 0;
use-after-free" warnings. On
some boots (3 of 5 here) it oopses inside the deferred-probe worker:
BUG: unable to handle page fault for address: 0000000a00000094
Workqueue: events_unbound deferred_probe_work_func
RIP: 0010:fwnode_graph_get_next_endpoint+0x42/0xc0
imx471_check_hwcfg+0x68/0x190 [imx471]
imx471_probe+0x31/0x4e0 [imx471]
i2c_device_probe ... deferred_probe_work_func
(One boot showed "BUG: kernel NULL pointer dereference, address:
0000000000000009" at the same RIP.)
IMPACT
- The webcam never works: the IPU7 device stays unbound.
- After the oops, the dead kworker leaves a probe in flight, so
wait_for_device_probe() never
returns. dpm_prepare() and device_shutdown() both call it, so:
* lid-close suspend never completes. The internal panel stays black on lid
open, external
displays get no signal, and a forced power-off is needed (attachment
suspend-hang-journal.txt;
the journal ends at "PM: suspend entry (s2idle)" / "Filesystems sync").
* reboot/shutdown can hang at the very end.
To users this looks like a display/graphics resume bug, which makes it hard
to diagnose.
STEPS TO REPRODUCE
1. Boot 7.0.0-38-generic on a machine with a SONY471A sensor (e.g. ThinkPad
X9-15 Gen 1).
2. dmesg | grep -E "SONY471A-0|IPU bridge init|refcount_t|BUG:"
-> the duplicate-name error and -EEXIST appear every boot; use-after-free
warnings or an oops follow.
3. If an oops occurred: close the lid. The machine never comes back from
suspend.
FIX
Drop the duplicate entry (attached
0001-ipu-bridge-drop-duplicate-SONY471A-entry.patch); keep
TBE20A0, which mainline doesn't have. The SAUCE patch's SONY471A line has been
redundant
since mainline added the entry.
TESTED
- I rebuilt ipu-bridge.ko from the linux_7.0.0-38.38 source package. The
unmodified build has the
same srcversion as the shipped module (4DB31BE24A1FDC6F27DA3A5), so the
source matches.
- With only the duplicate line removed:
"intel-ipu7 0000:00:05.0: Found supported sensor SONY471A:00", "Connected 1
cameras",
"imx471 i2c-SONY471A:00: imx471 probe successfully", "All sensor registration
completed".
No refcount warnings and no oops across several boots. Lid-close
suspend/resume works.
The camera works through libcamhal-ipu7x / icamerasrc / v4l2-relayd.
- linux-oem-26.04 7.0.0-1015.15: I didn't boot it, but the
ipu_supported_sensors[] table in its
shipped ipu-bridge.ko (read from the relocations) has the same two
consecutive SONY471A
entries, so it is affected too.
Note: the running system now uses the locally rebuilt ipu-bridge.ko (taint E).
The attached
logs are from boots of the unmodified stock kernel.
# Last journal lines of two boots on 7.0.0-38-generic where the same oops
occurred at boot.
# Lid close -> suspend never completes / never resumes; machine needed a forced
power-off.
## boot 9817a19537db4cc5a9cd69315c633da5
oops at boot: BUG: kernel NULL pointer dereference, address: 0000000000000009
2026-10-15T08:58:43+02:00 systemd-logind[1149]: Suspending...
2026-10-15T08:59:13+02:00 systemd[1]: Reached target sleep.target - Sleep.
2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Successfully froze unit
'user.slice'.
2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Performing sleep operation
'suspend'...
2026-10-15T08:59:13+02:00 kernel: PM: suspend entry (s2idle)
2026-10-15T08:59:13+02:00 kernel: Filesystems sync: 0.011 seconds
## boot 8c4e64b1100643058a7f1a25f338741d
oops at boot: BUG: unable to handle page fault for address: 000001a400000084
2026-10-15T11:59:47+02:00 systemd-logind[1272]: Suspending...
2026-10-15T11:59:49+02:00 systemd[1]: Reached target sleep.target - Sleep.
2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Successfully froze unit
'user.slice'.
2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Performing sleep operation
'suspend'...
2026-10-15T11:59:49+02:00 kernel: PM: suspend entry (s2idle)
2026-10-15T11:59:49+02:00 kernel: Filesystems sync: 0.010 seconds
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Attachment added: "dmesg-7.0.0-38-generic-oops.txt"
https://bugs.launchpad.net/bugs/2171043/+attachment/6009635/+files/dmesg-7.0.0-38-generic-oops.txt
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171043
Title:
ipu-bridge lists SONY471A twice (mainline + SAUCE): IPU7 probe fails
with -EEXIST, imx471 use-after-free oops, suspend hangs
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171043/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
