Created attachment 300449 [details] Logs from the crash on 5.15.22 kernel The error was first seen in kernel 5.4.42 with both Lenovo T470s and Lenovo T14 G1. It is still present with kernel 5.15.22. The kernel has the grsecurity patches active which causes released memory to be poisoned with the 0xfe value (seen in RAX in some traces). This seems to indicate some use after free here. These logs were created with the touchpad disabled in the UEFI. But the bug is happening also when having them enabled. The kernel crash does not happen on every boot. I would estimate a crash every 20 boots of the system. The kernel logs for 5.15.22 on a Lenovo T14G1 are attached: <3>[ 12.943063] rmi4_physical rmi4-00: Failed to read irqs, code=-6 <4>[ 12.946167] ------------[ cut here ]------------ <4>[ 12.946168] remove_proc_entry: removing non-empty directory 'irq/1', leaking at least 'i8042' <4>[ 12.946176] WARNING: CPU: 2 PID: 128 at fs/proc/generic.c:841 remove_proc_entry+0x16b/0x180 <4>[ 12.946183] Modules linked in: pinctrl_cannonlake pinctrl_intel dm_crypt_sina(O) dm_mod efivarfs ... <4>[ 12.946333] WARNING: CPU: 2 PID: 128 at kernel/irq/irqdomain.c:875 irq_dispose_mapping+0x113/0x140 <4>[ 12.946337] Modules linked in: pinctrl_cannonlake pinctrl_intel dm_crypt_sina(O) dm_mod efivarfs <4>[ 12.946340] CPU: 2 PID: 128 Comm: kworker/2:3 Tainted: G W O T 5.15.22-grsec+ #1 <4>[ 12.946341] Hardware name: LENOVO 20S1S19N00/20S1S19N00, BIOS N2XET00S (3.99 ) 10/08/2020 <4>[ 12.946342] Workqueue: events ffffffff81e0b330 <4>[ 12.946343] RIP: 0010:[<ffffffff814db363>] irq_dispose_mapping+0x113/0x140 ... <4>[ 12.946880] general protection fault, probably for non-canonical address 0xfefefefefefeff46: 0000 [#1] SMP NOPTI <4>[ 12.946926] CPU: 2 PID: 128 Comm: kworker/2:3 Tainted: G W O T 5.15.22-grsec+ #1 <4>[ 12.946960] Hardware name: LENOVO 20S1S19N00/20S1S19N00, BIOS N2XET00S (3.99 ) 10/08/2020 <4>[ 12.946993] Workqueue: events ffffffff81e0b330 <4>[ 12.947012] RIP: 0010:[<ffffffff814db2ec>] irq_dispose_mapping+0x9c/0x140
Created attachment 304419 [details] Patch fixing the problem I received a patch from the grsecurity team for this problem. It seems the problem is caused because the device is potentially used in the irq_dispose_mapping call after being put.
Based on the fix the problem was likely introduced with the commit: 24d28e4f1271 Input: synaptics-rmi4 - convert irq distribution to irq_domain in v4.18.