[Bug 205841] New: Lenovo USB-C dock audio NULL pointer

[Bug 205841] New: Lenovo USB-C dock audio NULL pointer

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=205841

            Bug ID: 205841
           Summary: Lenovo USB-C dock audio NULL pointer
           Product: Drivers
           Version: 2.5
    Kernel Version: 5.4.2
          Hardware: x86-64
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: USB
          Assignee: drivers_usb@kernel-bugs.kernel.org
          Reporter: owl@ow1.in
        Regression: No

Created attachment 286257
  --> https://bugzilla.kernel.org/attachment.cgi?id=286257&action=edit
Full dmesg

After rebuilding new kernel (5.4.2 instead 5.0.21) from blank config I've got a
problems with Dock audio. This bug affect all sound subsystem on my laptop. If
dock is detached - sound works perfectly (I use external usb sound card)

[    4.513754] usb 1-2.4.2.3: New USB device found, idVendor=17ef,
idProduct=3063, bcdDevice= 9.02
[    4.513755] usb 1-2.4.2.3: New USB device strings: Mfr=1, Product=2,
SerialNumber=3
[    4.513757] usb 1-2.4.2.3: Product: ThinkPad USB-C Dock Audio
[    4.513758] usb 1-2.4.2.3: Manufacturer: Lenovo
[    4.513758] usb 1-2.4.2.3: SerialNumber: 000000000000
[    4.614903] input: Lenovo ThinkPad USB-C Dock Audio as
/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2.4/1-2.4.2/1-2.4.2.3/1-2.4.2.3:1.3/0003:17EF:3063.0008/input/input25
[    4.666674] hid-generic 0003:17EF:3063.0008: input,hidraw7: USB HID v1.11
Device [Lenovo ThinkPad USB-C Dock Audio] on usb-0000:00:14.0-2.4.2.3/input3
[    8.011481] BUG: kernel NULL pointer dereference, address: 00000000000002de
[    8.011482] #PF: supervisor read access in kernel mode
[    8.011483] #PF: error_code(0x0000) - not-present page
[    8.011483] PGD 0 P4D 0 
[    8.011485] Oops: 0000 [#1] SMP NOPTI
[    8.011486] CPU: 0 PID: 51 Comm: kworker/0:1 Not tainted 5.4.2 #6
[    8.011486] Hardware name: LENOVO 20N8005JMH/20N8005JMH, BIOS R0YET34W (1.17
) 07/27/2019
[    8.011489] Workqueue: events_long ucsi_init
[    8.011492] RIP: 0010:typec_altmode_update_active+0x16/0xf0
[    8.011492] Code: ff ff ff 31 c0 c3 b8 ea ff ff ff c3 0f 1f 84 00 00 00 00
00 55 53 48 83 ec 10 65 48 8b 04 25 28 00 00 00 48 89 44 24 08 31 c0 <0f> b6 87
dc 02 00 00 83 e0 01 40 38 f0 0f 84 8d 00 00 00 48 8b 47
[    8.011493] RSP: 0018:ffffae1f00257dc8 EFLAGS: 00010246
[    8.011494] RAX: 0000000000000000 RBX: ffff9e60dbbc2270 RCX:
0000000000000000
[    8.011494] RDX: ffff9e60dcd18c28 RSI: 0000000000000000 RDI:
0000000000000002
[    8.011494] RBP: 0000000000000000 R08: 0000000000000000 R09:
0000000000000000
[    8.011495] R10: 0000000000000000 R11: 0000000000000001 R12:
0000000000000000
[    8.011495] R13: ffff9e60dcd18c00 R14: ffff9e60dbbc22c0 R15:
ffff9e60dbbc2000
[    8.011496] FS:  0000000000000000(0000) GS:ffff9e60e6200000(0000)
knlGS:0000000000000000
[    8.011496] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    8.011497] CR2: 00000000000002de CR3: 0000000193c0a006 CR4:
00000000003606f0
[    8.011497] Call Trace:
[    8.011499]  ucsi_altmode_update_active+0xa8/0xf0
[    8.011501]  ucsi_init+0x37e/0x570
[    8.011503]  process_one_work+0x1db/0x380
[    8.011504]  worker_thread+0x45/0x3c0
[    8.011505]  kthread+0xf6/0x130
[    8.011506]  ? process_one_work+0x380/0x380
[    8.011507]  ? kthread_park+0x80/0x80
[    8.011509]  ret_from_fork+0x35/0x40
[    8.011510] Modules linked in:
[    8.011511] CR2: 00000000000002de
[    8.011512] ---[ end trace 284cb2221d91180a ]---
[    8.011514] RIP: 0010:typec_altmode_update_active+0x16/0xf0
[    8.011514] Code: ff ff ff 31 c0 c3 b8 ea ff ff ff c3 0f 1f 84 00 00 00 00
00 55 53 48 83 ec 10 65 48 8b 04 25 28 00 00 00 48 89 44 24 08 31 c0 <0f> b6 87
dc 02 00 00 83 e0 01 40 38 f0 0f 84 8d 00 00 00 48 8b 47
[    8.011515] RSP: 0018:ffffae1f00257dc8 EFLAGS: 00010246
[    8.011515] RAX: 0000000000000000 RBX: ffff9e60dbbc2270 RCX:
0000000000000000
[    8.011516] RDX: ffff9e60dcd18c28 RSI: 0000000000000000 RDI:
0000000000000002
[    8.011516] RBP: 0000000000000000 R08: 0000000000000000 R09:
0000000000000000
[    8.011516] R10: 0000000000000000 R11: 0000000000000001 R12:
0000000000000000
[    8.011517] R13: ffff9e60dcd18c00 R14: ffff9e60dbbc22c0 R15:
ffff9e60dbbc2000
[    8.011517] FS:  0000000000000000(0000) GS:ffff9e60e6200000(0000)
knlGS:0000000000000000
[    8.011518] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    8.011518] CR2: 00000000000002de CR3: 0000000193c0a006 CR4:
00000000003606f0

...

[   59.149702] usb 1-2.4.2.3: Not enough bandwidth for new device state.
[   59.149707] usb 1-2.4.2.3: Not enough bandwidth for altsetting 1
[   59.149708] usb 1-2.4.2.3: 2:1: usb_set_interface failed (-28)
[   59.150124] usb 1-2.4.2.3: Not enough bandwidth for new device state.
[   59.150131] usb 1-2.4.2.3: Not enough bandwidth for altsetting 1
[   59.150132] usb 1-2.4.2.3: 2:1: usb_set_interface failed (-28)
[   59.150587] usb 1-2.4.2.3: Not enough bandwidth for new device state.
[   59.150594] usb 1-2.4.2.3: Not enough bandwidth for altsetting 1
[   59.150595] usb 1-2.4.2.3: 2:1: usb_set_interface failed (-28)
[   59.151075] usb 1-2.4.2.3: Not enough bandwidth for new device state.
[   59.151079] usb 1-2.4.2.3: Not enough bandwidth for altsetting 1
[   59.151080] usb 1-2.4.2.3: 2:1: usb_set_interface failed (-28)
[   59.151538] usb 1-2.4.2.3: Not enough bandwidth for new device state.
[   59.151545] usb 1-2.4.2.3: Not enough bandwidth for altsetting 1
[   59.151546] usb 1-2.4.2.3: 2:1: usb_set_interface failed (-28)

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

[Bug 205841] Lenovo USB-C dock audio NULL pointer

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=205841

--- Comment #1 from Ilia Pavlikhin (owl@ow1.in) ---
Created attachment 286259
  --> https://bugzilla.kernel.org/attachment.cgi?id=286259&action=edit
Current kernel configuration

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

[Bug 205841] Lenovo USB-C dock audio NULL pointer

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=205841

--- Comment #2 from Ilia Pavlikhin (owl@ow1.in) ---
Also I booted to old kernel (5.0.21) and sound works perfectly, but problem
with bandwidth is saved.

[    4.781746] usb 1-2.4.2.3: new full-speed USB device number 10 using
xhci_hcd
[    5.036633] usb 1-2.4.2.3: New USB device found, idVendor=17ef,
idProduct=3063, bcdDevice= 9.02
[    5.036634] usb 1-2.4.2.3: New USB device strings: Mfr=1, Product=2,
SerialNumber=3
[    5.036634] usb 1-2.4.2.3: Product: ThinkPad USB-C Dock Audio
[    5.036635] usb 1-2.4.2.3: Manufacturer: Lenovo
[    5.036636] usb 1-2.4.2.3: SerialNumber: 000000000000
[    5.105120] input: Lenovo ThinkPad USB-C Dock Audio as
/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2.4/1-2.4.2/1-2.4.2.3/1-2.4.2.3:1.3/0003:17EF:3063.0008/input/input14
[   23.706681] usb 1-2.4.2.3: Not enough bandwidth for new device state.
[   23.706696] usb 1-2.4.2.3: Not enough bandwidth for altsetting 1
[   23.706699] usb 1-2.4.2.3: 2:1: usb_set_interface failed (-28)
[   23.707166] usb 1-2.4.2.3: Not enough bandwidth for new device state.
[   23.707184] usb 1-2.4.2.3: Not enough bandwidth for altsetting 1
[   23.707187] usb 1-2.4.2.3: 2:1: usb_set_interface failed (-28)

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

[Bug 205841] Lenovo USB-C dock audio NULL pointer

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=205841

--- Comment #3 from Ilia Pavlikhin (owl@ow1.in) ---
Created attachment 286261
  --> https://bugzilla.kernel.org/attachment.cgi?id=286261&action=edit
Full dmesg 5.0.21

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

[Bug 205841] Lenovo USB-C dock audio NULL pointer

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=205841

Heikki Krogerus (heikki.krogerus@linux.intel.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |heikki.krogerus@linux.intel
                   |                            |.com

--- Comment #4 from Heikki Krogerus (heikki.krogerus@linux.intel.com) ---
The NULL pointer is coming from UCSI driver, and it should not have any effect
on audio. UCSI is a firmware interface that we use just for reading the status
of the USB Type-C connectors. The firmware does all the actual negotiation with
the partner device, so the Dock in this case. Which dock is it?

I'll see if I can reproduce the NULL pointer dereference, but you can just
disable the UCSI drivers in your kernel configuration to get rid of it. Any
issues with the audio should not be related to it.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

[Bug 205841] Lenovo USB-C dock audio NULL pointer

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=205841

--- Comment #5 from Ilia Pavlikhin (owl@ow1.in) ---
I use Lenovo Thinkpad USB-C Dock like this
https://support.lenovo.com/lv/en/accessories/acc100348 but not quite.

I have complex audio setup: alsa puts sound to pulseaudio, pa to jack and jack
puts audio to alsa and to physical output. When I boot to 5.4.2 - jack working
unstable - I'll try research this.

Also I'll try disable UCSI and return with results.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

[Bug 205841] Lenovo USB-C dock audio NULL pointer

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=205841

--- Comment #6 from Ilia Pavlikhin (owl@ow1.in) ---
Kernel was rebuilded without UCSI and NULL pointer is gone.

Also sounds seems working, no stucks, no artifacts, jack working fine.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

[Bug 205841] Lenovo USB-C dock audio NULL pointer

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=205841

--- Comment #7 from Ilia Pavlikhin (owl@ow1.in) ---
Created attachment 286263
  --> https://bugzilla.kernel.org/attachment.cgi?id=286263&action=edit
Full dmesg 5.4.2 wo UCSI

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

[Bug 205841] Lenovo USB-C dock audio NULL pointer

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=205841

--- Comment #8 from Ilia Pavlikhin (owl@ow1.in) ---
Hello, I was trying your patch with -rc1 kernel, but null pointer still exists.
Any news?

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

[Bug 205841] Lenovo USB-C dock audio NULL pointer

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=205841

--- Comment #9 from Ilia Pavlikhin (owl@ow1.in) ---
Created attachment 286481
  --> https://bugzilla.kernel.org/attachment.cgi?id=286481&action=edit
First pach for testing

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

[Bug 205841] Lenovo USB-C dock audio NULL pointer

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=205841

Serg Podtynnyi (serg@podtynnyi.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |serg@podtynnyi.com

--- Comment #10 from Serg Podtynnyi (serg@podtynnyi.com) ---
The same on 5.6.4 on Dell XPS 7390 2 in 1 while connecting D6000 USB-c dock
station


```
[ 8101.565555] WARNING: CPU: 0 PID: 11422 at kernel/module.c:1158
module_put.part.0+0xc9/0xd0
[ 8101.565560] Modules linked in: rfcomm bnep xt_nat veth nf_conntrack_netlink
xt_addrtype joydev hid_multitouch btusb btrtl btbcm btintel bluetooth
xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT ip6table_mangle ip6table_nat
iptable_mangle iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4
nf_tables ip6table_filter ip6_tables iptable_filter ip_tables bpfilter overlay
algif_aead mei_hdcp des_generic libdes md4 wmi_bmof dell_wmi
intel_wmi_thunderbolt dell_laptop dell_smbios dell_wmi_descriptor
snd_hda_codec_hdmi dcdbas dell_smm_hwmon snd_sof_pci snd_sof_intel_byt
snd_sof_intel_ipc snd_sof_intel_hda_common snd_sof_xtensa_dsp snd_sof
snd_sof_nocodec snd_soc_acpi_intel_match snd_hda_codec_realtek snd_soc_acpi
snd_hda_codec_generic snd_soc_core snd_compress snd_pcm_dmaengine ac97_bus
ledtrig_audio snd_hda_intel psmouse snd_intel_dspcfg typec_displayport
serio_raw snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_timer snd soundcore
i2c_i801 mei_me hid_sensor_magn_3d hid_sensor_rotation
[ 8101.565601]  mei hid_sensor_incl_3d hid_sensor_gyro_3d iwlmvm
hid_sensor_custom hid_sensor_als intel_lpss_pci iwlwifi intel_lpss idma64
cros_ec_ishtp virt_dma cros_ec thunderbolt processor_thermal_device
intel_soc_dts_iosf wmi battery i2c_hid int3403_thermal int340x_thermal_zone
soc_button_array intel_hid intel_pmc_core sparse_keymap int3400_thermal ac
acpi_thermal_rel pkcs8_key_parser atkbd libps2 i8042
[ 8101.565621] CPU: 0 PID: 11422 Comm: kworker/0:2 Tainted: G     U  W        
5.6.4-7937.native #1
[ 8101.565623] Hardware name: Dell Inc. XPS 13 7390 2-in-1/06CDVY, BIOS 1.3.1
03/02/2020
[ 8101.565629] Workqueue: events ucsi_handle_connector_change
[ 8101.565633] RIP: 0010:module_put.part.0+0xc9/0xd0
[ 8101.565636] Code: 24 48 85 c0 75 e3 65 ff 0d ac 15 df 46 75 8c e8 a3 b7 dd
ff eb 85 e8 84 b7 dd ff 5b 31 c0 41 5c 41 5d 5d 89 c2 89 c6 89 c7 c3 <0f> 0b e9
61 ff ff ff 48 85 ff 74 0d 55 48 89 e5 e8 22 ff ff ff 5d
[ 8101.565638] RSP: 0000:ffff96f303d63c78 EFLAGS: 00010297
[ 8101.565640] RAX: 0000000000000000 RBX: ffffffffc05a8140 RCX:
0000000000000000
[ 8101.565641] RDX: 00000000ffffffff RSI: 0000000000000000 RDI:
0000000000000000
[ 8101.565643] RBP: ffff96f303d63c90 R08: 0000000000000000 R09:
0000000000000000
[ 8101.565644] R10: 0000000000000000 R11: 0000000000000000 R12:
ffff928b5ff59008
[ 8101.565645] R13: 0000000000000000 R14: 0000000000000001 R15:
ffff928d69dee2a8
[ 8101.565647] FS:  0000000000000000(0000) GS:ffff928e7f600000(0000)
knlGS:0000000000000000
[ 8101.565649] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8101.565650] CR2: 00007f5bbb9328a9 CR3: 00000002bfa60003 CR4:
0000000000760ef0
[ 8101.565652] PKRU: 55555554
[ 8101.565653] Call Trace:
[ 8101.565660]  module_put+0xe/0x20
[ 8101.565664]  typec_altmode_update_active+0x4c/0xf0
[ 8101.565669]  typec_remove+0x86/0x90
[ 8101.565674]  device_release_driver_internal+0xf3/0x1c0
[ 8101.565677]  device_release_driver+0xd/0x20
[ 8101.565680]  bus_remove_device+0xdc/0x150
[ 8101.565684]  device_del+0x171/0x3f0
[ 8101.565688]  device_unregister+0x16/0x60
[ 8101.565690]  typec_unregister_altmode+0x2b/0x40
[ 8101.565694]  ucsi_unregister_altmodes+0x41/0x90
[ 8101.565697]  ucsi_unregister_partner.part.0+0x12/0x30
[ 8101.565700]  ucsi_handle_connector_change+0x221/0x311
[ 8101.565705]  ? kfree+0x256/0x270
[ 8101.565709]  process_one_work+0x19c/0x3a0
[ 8101.565712]  worker_thread+0x4b/0x3b0
[ 8101.565716]  kthread+0x101/0x140
[ 8101.565718]  ? process_one_work+0x3a0/0x3a0
[ 8101.565721]  ? kthread_park+0xa0/0xa0
[ 8101.565726]  ret_from_fork+0x1f/0x40
[ 8101.565729] ---[ end trace 227b0e97c6c80051 ]---
```

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

[Bug 205841] Lenovo USB-C dock audio NULL pointer

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=205841

--- Comment #11 from Heikki Krogerus (heikki.krogerus@linux.intel.com) ---
I should be able to get my hands on one of those Dell D6000 docks. Not sure
about the XPS 13 7390.

I'll see if I'm able to reproduce this one.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

[Bug 205841] Lenovo USB-C dock audio NULL pointer

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=205841

--- Comment #12 from Serg Podtynnyi (serg@podtynnyi.com) ---
In Red Hat https://bugzilla.redhat.com/show_bug.cgi?id=1772806
and retrace https://retrace.fedoraproject.org/faf/reports/2662737/

-- 
You are receiving this mail because:
You are watching the assignee of the bug.