#1135966 Oops under ucsi_handle_connector_change when disconnecting docking station (multiple backtraces included)

Package:
src:linux
Source:
src:linux
Submitter:
Josh Triplett
Date:
2026-06-07 02:43:02 UTC
Severity:
normal
Tags:
#1135966#3
Date:
2026-05-07 21:45:24 UTC
From:
To:
(Important because it's a kernel oops.)

Twice in a row now, I've had a kernel oops (GPF) when disconnecting my
docking station, that hung the system badly enough I had to
hard-power-off to recover (the display switched back to the internal
display but the system was non-responsive). This didn't occur with the
previous kernel. (This unfortunately doesn't reliably reproduce when I
attach and detach the docking station. Both times it happened, the
docking station had been attached for a while.)

I've attached both of the oops logs.

Please let me know if any other information would help.
#1135966#8
Date:
2026-05-17 12:29:44 UTC
From:
To:
Hello Josh,

Looks related to
https://lore.kernel.org/all/20251218071925.3459787-1-acelan.kao@canonical.com/.

Can you please test this patch? (If you need help here, please tell so.)

Best regards
Uwe
#1135966#15
Date:
2026-05-17 12:29:44 UTC
From:
To:
Hello Josh,

Looks related to
https://lore.kernel.org/all/20251218071925.3459787-1-acelan.kao@canonical.com/.

Can you please test this patch? (If you need help here, please tell so.)

Best regards
Uwe
#1135966#18
Date:
2026-06-07 02:28:10 UTC
From:
To:
Not sure if this is the same oops or just a similar one, but it seems
likely to be related.

Jun 06 19:20:55 o kernel: ------------[ cut here ]------------
Jun 06 19:20:55 o kernel: kernfs: can not remove 'typec', no directory
Jun 06 19:20:55 o kernel: WARNING: fs/kernfs/dir.c:1731 at kernfs_remove_by_name_ns+0xd0/0xe0, CPU#6: kworker/6:1/123
Jun 06 19:20:55 o kernel: Modules linked in: sd_mod scsi_mod scsi_common ccm snd_seq_dummy rfcomm snd_hrtimer snd_seq snd_soc_skl_hda_dsp snd_soc_intel_sof_board_helpers snd_sof_probes snd_soc_intel_hda_dsp_common cmac algif_hash algif_skcipher af_alg snd_hda_codec_intelhdmi snd_hda_codec_hdmi snd_hda_codec_alc269 snd_hda_codec_realtek_lib snd_hda_scodec_component snd_hda_codec_generic snd_soc_dmic snd_hda_intel xe snd_sof_pci_intel_tgl snd_sof_pci_intel_cnl snd_sof_intel_hda_generic soundwire_intel snd_sof_intel_hda_sdw_bpt snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda_mlink snd_sof_intel_hda soundwire_cadence snd_sof_pci snd_sof_xtensa_dsp snd_sof snd_sof_utils snd_soc_acpi_intel_match qrtr drm_gpuvm snd_soc_acpi_intel_sdca_quirks intel_uncore_frequency drm_gpusvm_helper soundwire_generic_allocation intel_uncore_frequency_common gpu_sched snd_soc_sdw_utils x86_pkg_temp_thermal iwlmvm drm_ttm_helper intel_powerclamp snd_soc_acpi drm_exec crc8 drm_suballoc_helper coretemp soundwire_bus kvm_intel snd_soc_sdca bnep
Jun 06 19:20:55 o kernel:  mac80211 snd_soc_avs kvm snd_soc_hda_codec snd_hda_ext_core snd_hda_codec uvcvideo snd_hda_core libarc4 videobuf2_vmalloc uvc snd_intel_dspcfg videobuf2_memops irqbypass videobuf2_v4l2 snd_intel_sdw_acpi rapl think_lmi btusb snd_usb_audio intel_cstate mei_pxp mei_hdcp snd_soc_core videodev mei_wdt nls_ascii iwlwifi btmtk nls_cp437 btrtl snd_usbmidi_lib vfat btbcm snd_compress intel_rapl_msr snd_hwdep fat binfmt_misc intel_uncore snd_ctl_led btintel snd_rawmidi videobuf2_common snd_pcm_dmaengine snd_seq_device firmware_attributes_class i915 wmi_bmof bluetooth mc cfg80211 snd_pcm mei_me thinkpad_acpi ecdh_generic mei nvram snd_timer rfkill snd drm_buddy processor_thermal_device_pci mei_vsc_hw processor_thermal_device soundcore ttm processor_thermal_wt_hint drm_display_helper soc_button_array ac platform_temperature_control int3403_thermal processor_thermal_soc_slider platform_profile intel_pmc_core cec processor_thermal_rfim rc_core processor_thermal_rapl pmt_telemetry intel_rapl_common pmt_discovery
Jun 06 19:20:55 o kernel:  pmt_class drm_client_lib int3400_thermal processor_thermal_wt_req intel_pmc_ssram_telemetry acpi_thermal_rel button drm_kms_helper intel_hid sparse_keymap processor_thermal_power_floor intel_vsec acpi_tad processor_thermal_mbox acpi_pad i2c_algo_bit int340x_thermal_zone igen6_edac joydev evdev parport_pc ppdev lp parport i2c_dev msr efi_pstore configfs nfnetlink efivarfs autofs4 ext4 crc16 mbcache jbd2 crc32c_cryptoapi r8153_ecm cdc_ether usbnet hid_lenovo r8152 mii usbhid dm_crypt dm_mod hid_multitouch hid_generic ucsi_acpi iTCO_wdt typec_ucsi xhci_pci i2c_hid_acpi intel_pmc_bxt i2c_hid drm xhci_hcd atlantic psmouse typec watchdog nvme roles ghash_clmulni_intel macsec aesni_intel hid serio_raw battery usbcore nvme_core thunderbolt video fan i2c_i801 nvme_keyring intel_lpss_pci nvme_auth hkdf wmi intel_lpss i2c_smbus usb_common idma64
Jun 06 19:20:55 o kernel: CPU: 6 UID: 0 PID: 123 Comm: kworker/6:1 Not tainted 7.0.10+deb14-amd64 #1 PREEMPT(lazy)  Debian 7.0.10-1
Jun 06 19:20:55 o kernel: Hardware name: LENOVO 21HMCTO1WW/21HMCTO1WW, BIOS N3XET65W (1.40 ) 01/27/2026
Jun 06 19:20:55 o kernel: Workqueue: events ucsi_handle_connector_change [typec_ucsi]
Jun 06 19:20:55 o kernel: RIP: 0010:kernfs_remove_by_name_ns+0xd0/0xe0
Jun 06 19:20:55 o kernel: Code: d4 b9 ff 31 c0 48 83 c4 10 5b 5d c3 cc cc cc cc 48 89 ef e8 22 d4 b9 ff b8 fe ff ff ff eb e6 0f 0b eb 9f 48 8d 3d 90 ff ae 01 <67> 48 0f b9 3a eb e7 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90
Jun 06 19:20:55 o kernel: RSP: 0018:ffffd222005c7dd8 EFLAGS: 00010246
Jun 06 19:20:55 o kernel: RAX: 00000000fffffffe RBX: ffff8e2609854800 RCX: 0000000000000000
Jun 06 19:20:55 o kernel: RDX: 0000000000000000 RSI: ffffffffc073751a RDI: ffffffff95b760f0
Jun 06 19:20:55 o kernel: RBP: ffff8e264292e008 R08: 0000000000000000 R09: ffffffff9494bc32
Jun 06 19:20:55 o kernel: R10: fffff564842fb800 R11: ffff8e2600042400 R12: ffff8e260935a8b0
Jun 06 19:20:55 o kernel: R13: ffff8e26000e4205 R14: 0000000000000000 R15: ffff8e26426ba500
Jun 06 19:20:55 o kernel: FS:  0000000000000000(0000) GS:ffff8e2dc8efc000(0000) knlGS:0000000000000000
Jun 06 19:20:55 o kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Jun 06 19:20:55 o kernel: CR2: 000055ddca0f6608 CR3: 000000085da2c005 CR4: 0000000000f72ef0
Jun 06 19:20:55 o kernel: PKRU: 55555554
Jun 06 19:20:55 o kernel: Call Trace:
Jun 06 19:20:55 o kernel:  <TASK>
Jun 06 19:20:55 o kernel:  typec_unregister_partner+0x69/0x100 [typec]
Jun 06 19:20:55 o kernel:  ucsi_unregister_partner+0x11c/0x160 [typec_ucsi]
Jun 06 19:20:55 o kernel:  ucsi_handle_connector_change+0x36e/0x400 [typec_ucsi]
Jun 06 19:20:55 o kernel:  process_one_work+0x19d/0x3a0
Jun 06 19:20:55 o kernel:  worker_thread+0x1af/0x320
Jun 06 19:20:55 o kernel:  ? __pfx_worker_thread+0x10/0x10
Jun 06 19:20:55 o kernel:  kthread+0xe3/0x120
Jun 06 19:20:55 o kernel:  ? __pfx_kthread+0x10/0x10
Jun 06 19:20:55 o kernel:  ret_from_fork+0x2c7/0x350
Jun 06 19:20:55 o kernel:  ? __pfx_kthread+0x10/0x10
Jun 06 19:20:55 o kernel:  ret_from_fork_asm+0x1a/0x30
Jun 06 19:20:55 o kernel:  </TASK>
Jun 06 19:20:55 o kernel: ---[ end trace 0000000000000000 ]---
Jun 06 19:20:55 o kernel: BUG: kernel NULL pointer dereference, address: 0000000000000000
Jun 06 19:20:55 o kernel: #PF: supervisor read access in kernel mode
Jun 06 19:20:55 o kernel: #PF: error_code(0x0000) - not-present page
Jun 06 19:20:55 o kernel: PGD 0 P4D 0
Jun 06 19:20:55 o kernel: Oops: Oops: 0000 [#1] SMP NOPTI
Jun 06 19:20:55 o kernel: CPU: 6 UID: 0 PID: 123 Comm: kworker/6:1 Tainted: G        W           7.0.10+deb14-amd64 #1 PREEMPT(lazy)  Debian 7.0.10-1
Jun 06 19:20:55 o kernel: Tainted: [W]=WARN
Jun 06 19:20:55 o kernel: Hardware name: LENOVO 21HMCTO1WW/21HMCTO1WW, BIOS N3XET65W (1.40 ) 01/27/2026
Jun 06 19:20:55 o kernel: Workqueue: events ucsi_handle_connector_change [typec_ucsi]
Jun 06 19:20:55 o kernel: RIP: 0010:strlen+0x4/0x30
Jun 06 19:20:55 o kernel: Code: f7 75 ec 31 c0 c3 cc cc cc cc 48 89 f8 c3 cc cc cc cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <80> 3f 00 74 18 48 89 f8 0f 1f 40 00 48 83 c0 01 80 38 00 75 f7 48
Jun 06 19:20:55 o kernel: RSP: 0018:ffffd222005c7d88 EFLAGS: 00010246
Jun 06 19:20:55 o kernel: RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
Jun 06 19:20:55 o kernel: RDX: ffff8e2602719b00 RSI: 0000000000000000 RDI: 0000000000000000
Jun 06 19:20:55 o kernel: RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff9494bc32
Jun 06 19:20:55 o kernel: R10: fffff564842fb800 R11: ffff8e2600042400 R12: 0000000000000000
Jun 06 19:20:55 o kernel: R13: ffff8e2642964198 R14: 0000000000000000 R15: ffff8e26426ba500
Jun 06 19:20:55 o kernel: FS:  0000000000000000(0000) GS:ffff8e2dc8efc000(0000) knlGS:0000000000000000
Jun 06 19:20:55 o kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Jun 06 19:20:55 o kernel: CR2: 0000000000000000 CR3: 000000085da2c005 CR4: 0000000000f72ef0
Jun 06 19:20:55 o kernel: PKRU: 55555554
Jun 06 19:20:55 o kernel: Call Trace:
Jun 06 19:20:55 o kernel:  <TASK>
Jun 06 19:20:55 o kernel:  kernfs_name_hash+0x8f/0xb0
Jun 06 19:20:55 o kernel:  kernfs_find_ns+0x56/0x110
Jun 06 19:20:55 o kernel:  kernfs_remove_by_name_ns+0x5a/0xe0
Jun 06 19:20:55 o kernel:  typec_unregister_partner+0xad/0x100 [typec]
Jun 06 19:20:55 o kernel:  ucsi_unregister_partner+0x11c/0x160 [typec_ucsi]
Jun 06 19:20:55 o kernel:  ucsi_handle_connector_change+0x36e/0x400 [typec_ucsi]
Jun 06 19:20:55 o kernel:  process_one_work+0x19d/0x3a0
Jun 06 19:20:55 o kernel:  worker_thread+0x1af/0x320
Jun 06 19:20:55 o kernel:  ? __pfx_worker_thread+0x10/0x10
Jun 06 19:20:55 o kernel:  kthread+0xe3/0x120
Jun 06 19:20:55 o kernel:  ? __pfx_kthread+0x10/0x10
Jun 06 19:20:55 o kernel:  ret_from_fork+0x2c7/0x350
Jun 06 19:20:55 o kernel:  ? __pfx_kthread+0x10/0x10
Jun 06 19:20:55 o kernel:  ret_from_fork_asm+0x1a/0x30
Jun 06 19:20:55 o kernel:  </TASK>
Jun 06 19:20:55 o kernel: Modules linked in: sd_mod scsi_mod scsi_common ccm snd_seq_dummy rfcomm snd_hrtimer snd_seq snd_soc_skl_hda_dsp snd_soc_intel_sof_board_helpers snd_sof_probes snd_soc_intel_hda_dsp_common cmac algif_hash algif_skcipher af_alg snd_hda_codec_intelhdmi snd_hda_codec_hdmi snd_hda_codec_alc269 snd_hda_codec_realtek_lib snd_hda_scodec_component snd_hda_codec_generic snd_soc_dmic snd_hda_intel xe snd_sof_pci_intel_tgl snd_sof_pci_intel_cnl snd_sof_intel_hda_generic soundwire_intel snd_sof_intel_hda_sdw_bpt snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda_mlink snd_sof_intel_hda soundwire_cadence snd_sof_pci snd_sof_xtensa_dsp snd_sof snd_sof_utils snd_soc_acpi_intel_match qrtr drm_gpuvm snd_soc_acpi_intel_sdca_quirks intel_uncore_frequency drm_gpusvm_helper soundwire_generic_allocation intel_uncore_frequency_common gpu_sched snd_soc_sdw_utils x86_pkg_temp_thermal iwlmvm drm_ttm_helper intel_powerclamp snd_soc_acpi drm_exec crc8 drm_suballoc_helper coretemp soundwire_bus kvm_intel snd_soc_sdca bnep
Jun 06 19:20:55 o kernel:  mac80211 snd_soc_avs kvm snd_soc_hda_codec snd_hda_ext_core snd_hda_codec uvcvideo snd_hda_core libarc4 videobuf2_vmalloc uvc snd_intel_dspcfg videobuf2_memops irqbypass videobuf2_v4l2 snd_intel_sdw_acpi rapl think_lmi btusb snd_usb_audio intel_cstate mei_pxp mei_hdcp snd_soc_core videodev mei_wdt nls_ascii iwlwifi btmtk nls_cp437 btrtl snd_usbmidi_lib vfat btbcm snd_compress intel_rapl_msr snd_hwdep fat binfmt_misc intel_uncore snd_ctl_led btintel snd_rawmidi videobuf2_common snd_pcm_dmaengine snd_seq_device firmware_attributes_class i915 wmi_bmof bluetooth mc cfg80211 snd_pcm mei_me thinkpad_acpi ecdh_generic mei nvram snd_timer rfkill snd drm_buddy processor_thermal_device_pci mei_vsc_hw processor_thermal_device soundcore ttm processor_thermal_wt_hint drm_display_helper soc_button_array ac platform_temperature_control int3403_thermal processor_thermal_soc_slider platform_profile intel_pmc_core cec processor_thermal_rfim rc_core processor_thermal_rapl pmt_telemetry intel_rapl_common pmt_discovery
Jun 06 19:20:55 o kernel:  pmt_class drm_client_lib int3400_thermal processor_thermal_wt_req intel_pmc_ssram_telemetry acpi_thermal_rel button drm_kms_helper intel_hid sparse_keymap processor_thermal_power_floor intel_vsec acpi_tad processor_thermal_mbox acpi_pad i2c_algo_bit int340x_thermal_zone igen6_edac joydev evdev parport_pc ppdev lp parport i2c_dev msr efi_pstore configfs nfnetlink efivarfs autofs4 ext4 crc16 mbcache jbd2 crc32c_cryptoapi r8153_ecm cdc_ether usbnet hid_lenovo r8152 mii usbhid dm_crypt dm_mod hid_multitouch hid_generic ucsi_acpi iTCO_wdt typec_ucsi xhci_pci i2c_hid_acpi intel_pmc_bxt i2c_hid drm xhci_hcd atlantic psmouse typec watchdog nvme roles ghash_clmulni_intel macsec aesni_intel hid serio_raw battery usbcore nvme_core thunderbolt video fan i2c_i801 nvme_keyring intel_lpss_pci nvme_auth hkdf wmi intel_lpss i2c_smbus usb_common idma64
Jun 06 19:20:55 o kernel: CR2: 0000000000000000
Jun 06 19:20:55 o kernel: ---[ end trace 0000000000000000 ]---
Jun 06 19:20:55 o kernel: RIP: 0010:strlen+0x4/0x30
Jun 06 19:20:55 o kernel: Code: f7 75 ec 31 c0 c3 cc cc cc cc 48 89 f8 c3 cc cc cc cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <80> 3f 00 74 18 48 89 f8 0f 1f 40 00 48 83 c0 01 80 38 00 75 f7 48
Jun 06 19:20:55 o kernel: RSP: 0018:ffffd222005c7d88 EFLAGS: 00010246
Jun 06 19:20:55 o kernel: RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
Jun 06 19:20:55 o kernel: RDX: ffff8e2602719b00 RSI: 0000000000000000 RDI: 0000000000000000
Jun 06 19:20:55 o kernel: RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff9494bc32
Jun 06 19:20:55 o kernel: R10: fffff564842fb800 R11: ffff8e2600042400 R12: 0000000000000000
Jun 06 19:20:55 o kernel: R13: ffff8e2642964198 R14: 0000000000000000 R15: ffff8e26426ba500
Jun 06 19:20:55 o kernel: FS:  0000000000000000(0000) GS:ffff8e2dc8efc000(0000) knlGS:0000000000000000
Jun 06 19:20:55 o kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Jun 06 19:20:55 o kernel: CR2: 0000000000000000 CR3: 000000085da2c005 CR4: 0000000000f72ef0
Jun 06 19:20:55 o kernel: PKRU: 55555554
Jun 06 19:20:55 o kernel: note: kworker/6:1[123] exited with irqs disabled
#1135966#23
Date:
2026-06-07 02:35:14 UTC
From:
To:
I'll give it a try. The bug isn't especially reproducible, though, so I
don't know if I'll be able to reliably tell if it's fixed. But I'll try
applying the patch, and I'll try to see if the problem recurs.
#1135966#28
Date:
2026-06-07 02:35:14 UTC
From:
To:
I'll give it a try. The bug isn't especially reproducible, though, so I
don't know if I'll be able to reliably tell if it's fixed. But I'll try
applying the patch, and I'll try to see if the problem recurs.