[PATCH 0/2] thunderbolt: Fix lost ring interrupts and an XDomain use-after-free

[Sven Neuhaus <sven-kernel@sven.de>]

Hi folks,

here are two independent fixes found while running an out-of-tree 
USB4 service driver between two hosts with AMD Strix Halo USB4 host 
routers (1022:158d, 1022:158e). The driver exchanges XDomain requests 
and responses in both directions and moves data over its own rings.

Patch 1 stops tb_xdomain_match() from matching received packets to the
requests that tb_xdomain_response() queues. Those requests have no
response buffer, and a match after their work has run makes the work
run again after the request was freed (refcount underflow in
tb_cfg_request_work()).

Patch 2 reads back the NHI after the ring's interrupt status is cleared
in ring_msix() on hosts without QUIRK_AUTO_CLEAR_INT. Without the read
the posted clear can take effect after the next frame has completed
and clear its status too, so that frame raises no interrupt. On these
hosts that left an XDomain request unprocessed until the sender timed
out (about 75 ms in 3-7% of request/reply exchanges), and data ring
completions were lost in the same way.

Each patch says how it was tested and what was not tested. Both apply
to the fixes branch (f1ae606eb404) and to 7.3.3. They were built on
7.3.3 with W=1 and add no warnings; they were not built on the fixes
branch. The analysis, the fixes and the tests were done
with an AI coding assistant.

Sven Neuhaus (2):
  thunderbolt: Do not match XDomain responses to received packets
  thunderbolt: Flush the ring interrupt status clear

 drivers/thunderbolt/nhi.c     | 8 ++++++++
 drivers/thunderbolt/xdomain.c | 7 +++++++
 2 files changed, 15 insertions(+)


base-commit: f1ae606eb404bca2498b9ad69b923073655556e4
-- 
2.47.3