Re: use-after-free with Lenovo Ultra Docking Station

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hey Greg,

The "Thunderbolt BIOS Assist Mode" option in the BIOS settings may have an effect on this. I have to test this intensively first.

Thank you.
Philipp


On Fri, Feb 21, 2025 at 08:48:52AM +0100, Philipp Leskovitz wrote:
Hello Greg,

I can also reproduce it without the proprietary modules. The latest BIOS
version N2IETA5W is installed. Attached is the log file. Only dm_mod,
intel_lpss_pci, intel_lpss, pinctrl_cannonlake and pinctrl_intel were still
loaded. I had also activated kasan.

Kernel version 6.1 seems to be one of the last versions with which the docking station works well.

The error doesn't always occur. I stress the device a little bit by
connecting the notebook to the docking station and disconnecting it again.
Sometimes I also plug in an external power supply. This combination
generates the error in less than 10 minutes. I also had the case that the
device was idle for about 30 minutes. Then it was connected to the docking
station once and the error occurred.

Your kernel log shows that this is probably a bios bug:

[  520.107312] pcieport 0000:03:02.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 3a] add_size 200000 add_align 100000
[  520.107323] pcieport 0000:03:02.0: bridge window [mem 0xa0000000-0xa01fffff 64bit pref]: assigned
[  520.107601] pci_bus 0000:3a: busn_res: [bus 3a] is released
[  520.109588] pci_bus 0000:03: busn_res: [bus 03-3a] is released
[  522.973010] ACPI BIOS Error (bug): Could not resolve symbol [\_SB.PCI0.RP09.PEGP.NVDN], AE_NOT_FOUND (20240827/psargs-332)
[  522.973048] ACPI Error: Aborting method \_SB.PCI0.LPCB.EC._Q26 due to previous error (AE_NOT_FOUND) (20240827/psparse-529)
[  529.409351] ACPI BIOS Error (bug): Could not resolve symbol [\_SB.PCI0.RP09.PEGP.NVDN], AE_NOT_FOUND (20240827/psargs-332)
[  529.409395] ACPI Error: Aborting method \_SB.PCI0.LPCB.EC._Q27 due to previous error (AE_NOT_FOUND) (20240827/psparse-529)
[  543.303502] usb 1-5: new high-speed USB device number 12 using xhci_hcd
[  543.340048] ACPI BIOS Error (bug): Could not resolve symbol [\_SB.PCI0.RP09.PEGP.NVDN], AE_NOT_FOUND (20240827/psargs-332)
[  543.340092] ACPI Error: Aborting method \_SB.PCI0.LPCB.EC._Q26 due to previous error (AE_NOT_FOUND) (20240827/psparse-529)

And then later:

[  647.629519] hub 1-5:1.0: USB hub found
[  647.630656] hub 1-5:1.0: 5 ports detected
[  647.656103] ACPI BIOS Error (bug): Could not resolve symbol [\_SB.PCI0.RP09.PEGP.NVDN], AE_NOT_FOUND (20240827/psargs-332)
[  647.656140] ACPI Error: Aborting method \_SB.PCI0.LPCB.EC._Q26 due to previous error (AE_NOT_FOUND) (20240827/psparse-529)
[  647.738644] ==================================================================
[  647.738648] BUG: KASAN: slab-use-after-free in sysfs_create_link+0x8a/0xc0

Boom.

Now what is odd is that sysfs_create_link is showing a use-after-free,
which it shouldn't, but as your bios is spitting out invalid device
symbols, who knows what confusion the kernel got into with regards to
creating a symlink that was already present.

So maybe go poke the bios vendor to resolve this?

thanks,

greg k-h





[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux