]> www.infradead.org Git - users/jedix/linux-maple.git/commit
thunderbolt: Prevent use-after-free in resume from hibernate
authorMika Westerberg <mika.westerberg@linux.intel.com>
Mon, 3 Mar 2025 17:40:29 +0000 (19:40 +0200)
committerMika Westerberg <mika.westerberg@linux.intel.com>
Fri, 7 Mar 2025 12:00:58 +0000 (14:00 +0200)
commit502843396ec2a3eb4f58a2e4618a4a85fc5e0f46
tree2b6ee154dc2ee8e34e4184c87673db9dbe2ed244
parent7eb172143d5508b4da468ed59ee857c6e5e01da6
thunderbolt: Prevent use-after-free in resume from hibernate

Kenneth noticed that his laptop crashes randomly when resuming from
hibernate if there is device connected and display tunneled. I was able
to reproduce this as well with the following steps:

  1. Boot the system up, nothing connected.
  2. Connect Thunderbolt 4 dock to the host.
  3. Connect monitor to the Thunderbolt 4 dock.
  4. Verify that there is picture on the screen.
  5. Enter hibernate.
  6. Exit hibernate.
  7. Wait for the system to resume.

  Expectation: System resumes just fine, the connected monitor still
               shows screen.
  Actual result: There is crash during resume, screen is blank.

What happens is that during resume from hibernate we tear down any
existing tunnels created by the boot kernel and this ends up calling
tb_dp_dprx_stop() which calls tb_tunnel_put() dropping the reference
count to zero even though we never called tb_dp_dprx_start() for it (we
never do that for discovery). This makes the discovered DP tunnel memory
to be released and any access after that causes use-after-free and
possible crash.

Fix this so that we only stop DPRX flow if it has been started in the
first place.

Reported-by: Kenneth Crudup <kenny@panix.com>
Closes: https://lore.kernel.org/linux-usb/8e175721-806f-45d6-892a-bd3356af80c9@panix.com/
Cc: stable@vger.kernel.org
Fixes: d6d458d42e1e ("thunderbolt: Handle DisplayPort tunnel activation asynchronously")
Reviewed-by: Yehezkel Bernat <YehezkelShB@gmail.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
drivers/thunderbolt/tunnel.c
drivers/thunderbolt/tunnel.h