Re: use-after-free with Lenovo Ultra Docking Station

[Philipp Leskovitz <philipp.leskovitz@secunet.com>]

Hey Greg,

The "Thunderbolt BIOS Assist Mode" option in the BIOS settings may have an effect on this. I have to test this intensively first.

Thank you.
Philipp


> On Fri, Feb 21, 2025 at 08:48:52AM +0100, Philipp Leskovitz wrote:
>> Hello Greg,
>>
>> I can also reproduce it without the proprietary modules. The latest BIOS
>> version N2IETA5W is installed. Attached is the log file. Only dm_mod,
>> intel_lpss_pci, intel_lpss, pinctrl_cannonlake and pinctrl_intel were still
>> loaded. I had also activated kasan.
>>
>> Kernel version 6.1 seems to be one of the last versions with which the docking station works well.
>>
>> The error doesn't always occur. I stress the device a little bit by
>> connecting the notebook to the docking station and disconnecting it again.
>> Sometimes I also plug in an external power supply. This combination
>> generates the error in less than 10 minutes. I also had the case that the
>> device was idle for about 30 minutes. Then it was connected to the docking
>> station once and the error occurred.
> 
> Your kernel log shows that this is probably a bios bug:
> 
>> [  520.107312] pcieport 0000:03:02.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 3a] add_size 200000 add_align 100000
>> [  520.107323] pcieport 0000:03:02.0: bridge window [mem 0xa0000000-0xa01fffff 64bit pref]: assigned
>> [  520.107601] pci_bus 0000:3a: busn_res: [bus 3a] is released
>> [  520.109588] pci_bus 0000:03: busn_res: [bus 03-3a] is released
>> [  522.973010] ACPI BIOS Error (bug): Could not resolve symbol [\_SB.PCI0.RP09.PEGP.NVDN], AE_NOT_FOUND (20240827/psargs-332)
>> [  522.973048] ACPI Error: Aborting method \_SB.PCI0.LPCB.EC._Q26 due to previous error (AE_NOT_FOUND) (20240827/psparse-529)
>> [  529.409351] ACPI BIOS Error (bug): Could not resolve symbol [\_SB.PCI0.RP09.PEGP.NVDN], AE_NOT_FOUND (20240827/psargs-332)
>> [  529.409395] ACPI Error: Aborting method \_SB.PCI0.LPCB.EC._Q27 due to previous error (AE_NOT_FOUND) (20240827/psparse-529)
>> [  543.303502] usb 1-5: new high-speed USB device number 12 using xhci_hcd
>> [  543.340048] ACPI BIOS Error (bug): Could not resolve symbol [\_SB.PCI0.RP09.PEGP.NVDN], AE_NOT_FOUND (20240827/psargs-332)
>> [  543.340092] ACPI Error: Aborting method \_SB.PCI0.LPCB.EC._Q26 due to previous error (AE_NOT_FOUND) (20240827/psparse-529)
> 
> And then later:
> 
>> [  647.629519] hub 1-5:1.0: USB hub found
>> [  647.630656] hub 1-5:1.0: 5 ports detected
>> [  647.656103] ACPI BIOS Error (bug): Could not resolve symbol [\_SB.PCI0.RP09.PEGP.NVDN], AE_NOT_FOUND (20240827/psargs-332)
>> [  647.656140] ACPI Error: Aborting method \_SB.PCI0.LPCB.EC._Q26 due to previous error (AE_NOT_FOUND) (20240827/psparse-529)
>> [  647.738644] ==================================================================
>> [  647.738648] BUG: KASAN: slab-use-after-free in sysfs_create_link+0x8a/0xc0
> 
> Boom.
> 
> Now what is odd is that sysfs_create_link is showing a use-after-free,
> which it shouldn't, but as your bios is spitting out invalid device
> symbols, who knows what confusion the kernel got into with regards to
> creating a symlink that was already present.
> 
> So maybe go poke the bios vendor to resolve this?
> 
> thanks,
> 
> greg k-h