Re: use-after-free with Lenovo Ultra Docking Station

[Greg KH <gregkh@linuxfoundation.org>]

On Fri, Feb 21, 2025 at 08:48:52AM +0100, Philipp Leskovitz wrote:
> Hello Greg,
> 
> I can also reproduce it without the proprietary modules. The latest BIOS
> version N2IETA5W is installed. Attached is the log file. Only dm_mod,
> intel_lpss_pci, intel_lpss, pinctrl_cannonlake and pinctrl_intel were still
> loaded. I had also activated kasan.
> 
> Kernel version 6.1 seems to be one of the last versions with which the docking station works well.
> 
> The error doesn't always occur. I stress the device a little bit by
> connecting the notebook to the docking station and disconnecting it again.
> Sometimes I also plug in an external power supply. This combination
> generates the error in less than 10 minutes. I also had the case that the
> device was idle for about 30 minutes. Then it was connected to the docking
> station once and the error occurred.

Your kernel log shows that this is probably a bios bug:

> [  520.107312] pcieport 0000:03:02.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 3a] add_size 200000 add_align 100000
> [  520.107323] pcieport 0000:03:02.0: bridge window [mem 0xa0000000-0xa01fffff 64bit pref]: assigned
> [  520.107601] pci_bus 0000:3a: busn_res: [bus 3a] is released
> [  520.109588] pci_bus 0000:03: busn_res: [bus 03-3a] is released
> [  522.973010] ACPI BIOS Error (bug): Could not resolve symbol [\_SB.PCI0.RP09.PEGP.NVDN], AE_NOT_FOUND (20240827/psargs-332)
> [  522.973048] ACPI Error: Aborting method \_SB.PCI0.LPCB.EC._Q26 due to previous error (AE_NOT_FOUND) (20240827/psparse-529)
> [  529.409351] ACPI BIOS Error (bug): Could not resolve symbol [\_SB.PCI0.RP09.PEGP.NVDN], AE_NOT_FOUND (20240827/psargs-332)
> [  529.409395] ACPI Error: Aborting method \_SB.PCI0.LPCB.EC._Q27 due to previous error (AE_NOT_FOUND) (20240827/psparse-529)
> [  543.303502] usb 1-5: new high-speed USB device number 12 using xhci_hcd
> [  543.340048] ACPI BIOS Error (bug): Could not resolve symbol [\_SB.PCI0.RP09.PEGP.NVDN], AE_NOT_FOUND (20240827/psargs-332)
> [  543.340092] ACPI Error: Aborting method \_SB.PCI0.LPCB.EC._Q26 due to previous error (AE_NOT_FOUND) (20240827/psparse-529)

And then later:

> [  647.629519] hub 1-5:1.0: USB hub found
> [  647.630656] hub 1-5:1.0: 5 ports detected
> [  647.656103] ACPI BIOS Error (bug): Could not resolve symbol [\_SB.PCI0.RP09.PEGP.NVDN], AE_NOT_FOUND (20240827/psargs-332)
> [  647.656140] ACPI Error: Aborting method \_SB.PCI0.LPCB.EC._Q26 due to previous error (AE_NOT_FOUND) (20240827/psparse-529)
> [  647.738644] ==================================================================
> [  647.738648] BUG: KASAN: slab-use-after-free in sysfs_create_link+0x8a/0xc0

Boom.

Now what is odd is that sysfs_create_link is showing a use-after-free,
which it shouldn't, but as your bios is spitting out invalid device
symbols, who knows what confusion the kernel got into with regards to
creating a symlink that was already present.

So maybe go poke the bios vendor to resolve this?

thanks,

greg k-h