Provided support information as requested. thank you On Mon, 19 Oct 2026 at 05:40, Changwei Zou <[email protected]> wrote:
> Thank you very much for reporting this issue. > Could you please provide more information? > Please boot into the Ubuntu kernel and run the following command in a > terminal > to collect debugging information and attach it to this report. > > $ sudo apport-collect 2171043 > > ** Changed in: linux (Ubuntu) > Status: New => Incomplete > > -- > You received this bug notification because you are subscribed to the bug > report. > https://bugs.launchpad.net/bugs/2171043 > > Title: > ipu-bridge lists SONY471A twice (mainline + SAUCE): IPU7 probe fails > with -EEXIST, imx471 use-after-free oops, suspend hangs > > Status in linux package in Ubuntu: > Incomplete > > Bug description: > Release: Ubuntu 26.04 (resolute) > Kernel: linux-image-7.0.0-38-generic 7.0.0-38.38 (also present in > linux-oem-26.04 7.0.0-1015.15) > Machine: Lenovo ThinkPad X9-15 Gen 1 (21Q6001FZA), BIOS N4CET41W (1.17), > Lunar Lake, > IPU7 8086:645d, Sony IMX471 sensor (ACPI HID SONY471A) > > PROBLEM > > In drivers/media/pci/intel/ipu-bridge.c in 7.0.0-38.38, > ipu_supported_sensors[] contains > IPU_SENSOR_CONFIG("SONY471A", 1, 200000000) twice: > > - line 107: from mainline v7.0. It is present in > linux_7.0.0.orig.tar.gz. > - line 111: added again by the carried patch > "UBUNTU: SAUCE: media: ipu-bridge: Support imx471 sensor" (LP: > #2107320). > > ipu_bridge_connect_sensors() handles the second entry, finds the same > ACPI device and tries > to register software nodes with the same names. intel-ipu7 then fails to > probe on every boot: > > sysfs: cannot create duplicate filename > '/kernel/software_nodes/SONY471A-0' > kobject: kobject_add_internal failed for SONY471A-0 with -EEXIST, ... > intel-ipu7 0000:00:05.0: error -EEXIST: IPU bridge init failed > intel-ipu7 0000:00:05.0: probe with driver intel-ipu7 failed with > error -17 > > The error path unregisters the bridge's software nodes, but the imx471 > sensor driver > (ubuntu/dkms/ipu6/imx471.ko) is probing against those nodes. > imx471_check_hwcfg() then uses > freed fwnode memory. Every boot logs "refcount_t: addition on 0; > use-after-free" warnings. On > some boots (3 of 5 here) it oopses inside the deferred-probe worker: > > BUG: unable to handle page fault for address: 0000000a00000094 > Workqueue: events_unbound deferred_probe_work_func > RIP: 0010:fwnode_graph_get_next_endpoint+0x42/0xc0 > imx471_check_hwcfg+0x68/0x190 [imx471] > imx471_probe+0x31/0x4e0 [imx471] > i2c_device_probe ... deferred_probe_work_func > > (One boot showed "BUG: kernel NULL pointer dereference, address: > 0000000000000009" at the same RIP.) > > IMPACT > > - The webcam never works: the IPU7 device stays unbound. > - After the oops, the dead kworker leaves a probe in flight, so > wait_for_device_probe() never > returns. dpm_prepare() and device_shutdown() both call it, so: > * lid-close suspend never completes. The internal panel stays black on > lid open, external > displays get no signal, and a forced power-off is needed (attachment > suspend-hang-journal.txt; > the journal ends at "PM: suspend entry (s2idle)" / "Filesystems > sync"). > * reboot/shutdown can hang at the very end. > To users this looks like a display/graphics resume bug, which makes it > hard to diagnose. > > STEPS TO REPRODUCE > > 1. Boot 7.0.0-38-generic on a machine with a SONY471A sensor (e.g. > ThinkPad X9-15 Gen 1). > 2. dmesg | grep -E "SONY471A-0|IPU bridge init|refcount_t|BUG:" > -> the duplicate-name error and -EEXIST appear every boot; > use-after-free warnings or an oops follow. > 3. If an oops occurred: close the lid. The machine never comes back from > suspend. > > FIX > > Drop the duplicate entry (attached > 0001-ipu-bridge-drop-duplicate-SONY471A-entry.patch); keep > TBE20A0, which mainline doesn't have. The SAUCE patch's SONY471A line > has been redundant > since mainline added the entry. > > TESTED > > - I rebuilt ipu-bridge.ko from the linux_7.0.0-38.38 source package. The > unmodified build has the > same srcversion as the shipped module (4DB31BE24A1FDC6F27DA3A5), so > the source matches. > - With only the duplicate line removed: > "intel-ipu7 0000:00:05.0: Found supported sensor SONY471A:00", > "Connected 1 cameras", > "imx471 i2c-SONY471A:00: imx471 probe successfully", "All sensor > registration completed". > No refcount warnings and no oops across several boots. Lid-close > suspend/resume works. > The camera works through libcamhal-ipu7x / icamerasrc / v4l2-relayd. > - linux-oem-26.04 7.0.0-1015.15: I didn't boot it, but the > ipu_supported_sensors[] table in its > shipped ipu-bridge.ko (read from the relocations) has the same two > consecutive SONY471A > entries, so it is affected too. > > Note: the running system now uses the locally rebuilt ipu-bridge.ko > (taint E). The attached > logs are from boots of the unmodified stock kernel. > > > # Last journal lines of two boots on 7.0.0-38-generic where the same > oops occurred at boot. > # Lid close -> suspend never completes / never resumes; machine needed a > forced power-off. > > ## boot 9817a19537db4cc5a9cd69315c633da5 > oops at boot: BUG: kernel NULL pointer dereference, address: > 0000000000000009 > 2026-10-15T08:58:43+02:00 systemd-logind[1149]: Suspending... > 2026-10-15T08:59:13+02:00 systemd[1]: Reached target sleep.target - > Sleep. > 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Successfully froze unit > 'user.slice'. > 2026-10-15T08:59:13+02:00 systemd-sleep[29292]: Performing sleep > operation 'suspend'... > 2026-10-15T08:59:13+02:00 kernel: PM: suspend entry (s2idle) > 2026-10-15T08:59:13+02:00 kernel: Filesystems sync: 0.011 seconds > > ## boot 8c4e64b1100643058a7f1a25f338741d > oops at boot: BUG: unable to handle page fault for address: > 000001a400000084 > 2026-10-15T11:59:47+02:00 systemd-logind[1272]: Suspending... > 2026-10-15T11:59:49+02:00 systemd[1]: Reached target sleep.target - > Sleep. > 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Successfully froze unit > 'user.slice'. > 2026-10-15T11:59:49+02:00 systemd-sleep[15196]: Performing sleep > operation 'suspend'... > 2026-10-15T11:59:49+02:00 kernel: PM: suspend entry (s2idle) > 2026-10-15T11:59:49+02:00 kernel: Filesystems sync: 0.010 seconds > > To manage notifications about this bug go to: > https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171043/+subscriptions > > -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2171043 Title: ipu-bridge lists SONY471A twice (mainline + SAUCE): IPU7 probe fails with -EEXIST, imx471 use-after-free oops, suspend hangs To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171043/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
