linuxmsm/laptops-kernel
0
0 Fork 0
mirror of https://github.com/linux-msm/laptops-kernel.git synced 2026-08-13 14:19:53 -07:00
Code Issues Packages Projects Releases Wiki Activity
1,381,726 Commits 3 Branches 5 Tags
67600ccfc4f38ebd331b9332ac94717bfbc87ea7
Commit Graph
1381726 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Duoming Zhou 67600ccfc4 thunderbolt: Fix use-after-free in tb_dp_dprx_work 
The original code relies on cancel_delayed_work() in tb_dp_dprx_stop(),
which does not ensure that the delayed work item tunnel->dprx_work has
fully completed if it was already running. This leads to use-after-free
scenarios where tb_tunnel is deallocated by tb_tunnel_put(), while
tunnel->dprx_work remains active and attempts to dereference tb_tunnel
in tb_dp_dprx_work().

A typical race condition is illustrated below:

CPU 0                            | CPU 1
tb_dp_tunnel_active()            |
  tb_deactivate_and_free_tunnel()| tb_dp_dprx_start()
    tb_tunnel_deactivate()       |   queue_delayed_work()
      tb_dp_activate()           |
        tb_dp_dprx_stop()        | tb_dp_dprx_work() //delayed worker
          cancel_delayed_work()  |
    tb_tunnel_put(tunnel);       |
                                 |   tunnel = container_of(...); //UAF
                                 |   tunnel-> //UAF

Replacing cancel_delayed_work() with cancel_delayed_work_sync() is
not feasible as it would introduce a deadlock: both tb_dp_dprx_work()
and the cleanup path acquire tb->lock, and cancel_delayed_work_sync()
would wait indefinitely for the work item that cannot proceed.

Instead, implement proper reference counting:
- If cancel_delayed_work() returns true (work is pending), we release
  the reference in the stop function.
- If it returns false (work is executing or already completed), the
  reference is released in delayed work function itself.

This ensures the tb_tunnel remains valid during work item execution
while preventing memory leaks.

This bug was found by static analysis.

Fixes: d6d458d42e ("thunderbolt: Handle DisplayPort tunnel activation asynchronously")
Cc: stable@vger.kernel.org
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-23 17:16:38 +02:00
Alan Borzeszkowski ea6bb47fd6 thunderbolt: Update thunderbolt.h header file 
Make Thunderbolt header file compliant with current kernel-doc
standards. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:33:00 +02:00
Alan Borzeszkowski 81a1962cb2 thunderbolt: Update xdomain.c function documentation 
Make xdomain.c function documentation compliant with current kernel-doc
standards. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:33:00 +02:00
Alan Borzeszkowski a2ba553cd4 thunderbolt: Update usb4_port.c function documentation 
Make usb4_port.c function documentation compliant with current kernel-doc
standards. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:33:00 +02:00
Alan Borzeszkowski 9a5abaf8be thunderbolt: Update usb4.c function documentation 
Make usb4.c function documentation compliant with current kernel-doc
standards. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:33:00 +02:00
Alan Borzeszkowski e262b91b22 thunderbolt: Update tunnel.h function documentation 
Make tunnel.h function documentation compliant with current kernel-doc
standards. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:33:00 +02:00
Alan Borzeszkowski 6f3ed985b7 thunderbolt: Update tunnel.c function documentation 
Make tunnel.c function documentation compliant with current kernel-doc
standards. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:33:00 +02:00
Alan Borzeszkowski 371c237444 thunderbolt: Update tmu.c function documentation 
Make tmu.c function documentation compliant with current kernel-doc
standards. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:32:59 +02:00
Alan Borzeszkowski b30234f273 thunderbolt: Add missing documentation in tb.h 
Add missing parameters and struct/enum description in tb.h kernel-doc
comments. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:32:59 +02:00
Alan Borzeszkowski 978a3d608f thunderbolt: Update tb.h function documentation 
Make tb.h function documentation compliant with current kernel-doc
standards. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:32:59 +02:00
Alan Borzeszkowski d05cc39d1d thunderbolt: Update tb.c function documentation 
Make tb.c function documentation compliant with current kernel-doc
standards. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:32:59 +02:00
Alan Borzeszkowski 207b8a2605 thunderbolt: Update switch.c function documentation 
Make switch.c function documentation compliant with current kernel-doc
standards. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:32:59 +02:00
Alan Borzeszkowski f72f4d5cdb thunderbolt: Update retimer.c function documentation 
Make retimer.c function documentation compliant with current kernel-doc
standards. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:32:59 +02:00
Alan Borzeszkowski d015642ad3 thunderbolt: Update property.c function documentation 
Make property.c function documentation compliant with current kernel-doc
standards. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:32:59 +02:00
Alan Borzeszkowski a6e3f939ad thunderbolt: Update path.c function documentation 
Make path.c function documentation compliant with current kernel-doc
standards. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:32:59 +02:00
Alan Borzeszkowski fe83a27383 thunderbolt: Update nvm.c function documentation 
Make nvm.c function documentation compliant with current kernel-doc
standards. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:32:59 +02:00
Alan Borzeszkowski bbbca9bfd1 thunderbolt: Add missing documentation in nhi_regs.h ring_desc structure 
Add missing description of fields in ring_desc struct found in
"nhi_regs.h". No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:32:59 +02:00
Alan Borzeszkowski a385238050 thunderbolt: Update nhi.c function documentation 
Make nhi.c function documentation compliant with current kernel-doc
standards. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:32:59 +02:00
Alan Borzeszkowski 4815b7548c thunderbolt: Update lc.c function documentation 
Make lc.c function documentation compliant with current kernel-doc
standards. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:32:59 +02:00
Alan Borzeszkowski 728ab0e4a0 thunderbolt: Update eeprom.c function documentation 
Make eeprom.c function documentation compliant with current kernel-doc
standards. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:32:59 +02:00
Alan Borzeszkowski 250afc7f39 thunderbolt: Update domain.c function documentation 
Make domain.c function documentation compliant with current kernel-doc
standards. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:32:58 +02:00
Alan Borzeszkowski a84be45d33 thunderbolt: Update dma_port.c function documentation 
Make dma_port.c function documentation compliant with current kernel-doc
standards. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:32:58 +02:00
Alan Borzeszkowski 12cb68e486 thunderbolt: Add missing documentation in ctl.h tb_cfg_request struct 
Add missing @request field description in tb_cfg_request struct
kernel-doc. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:32:58 +02:00
Alan Borzeszkowski 38f33b8e2c thunderbolt: Update ctl.c function documentation 
Make ctl.c function documentation compliant with current kernel-doc
standards. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:32:58 +02:00
Alan Borzeszkowski 66cf14cc9f thunderbolt: Update clx.c function documentation 
Make clx.c function documentation compliant with current kernel-doc
standards. No functional changes.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
 2025-09-17 07:32:58 +02:00