Re: [PATCH] thunderbolt: Prevent use-after-free in resume from hibernate

[Mika Westerberg <mika.westerberg@linux.intel.com>]

On Thu, Mar 06, 2025 at 04:45:22PM +0100, Greg KH wrote:
> On Thu, Mar 06, 2025 at 10:41:45AM +0200, Mika Westerberg wrote:
> > Kenneth noticed that his laptop crashes randomly when resuming from
> > hibernate if there is device connected and display tunneled. I was able
> > to reproduce this as well with the following steps:
> > 
> >   1. Boot the system up, nothing connected.
> >   2. Connect Thunderbolt 4 dock to the host.
> >   3. Connect monitor to the Thunderbolt 4 dock.
> >   4. Verify that there is picture on the screen.
> >   5. Enter hibernate.
> >   6. Exit hibernate.
> >   7. Wait for the system to resume.
> > 
> >   Expectation: System resumes just fine, the connected monitor still
> >                shows screen.
> >   Actual result: There is crash during resume, screen is blank.
> > 
> > What happens is that during resume from hibernate we tear down any
> > existing tunnels created by the boot kernel and this ends up calling
> > tb_dp_dprx_stop() which calls tb_tunnel_put() dropping the reference
> > count to zero even though we never called tb_dp_dprx_start() for it (we
> > never do that for discovery). This makes the discovered DP tunnel memory
> > to be released and any access after that causes use-after-free and
> > possible crash.
> > 
> > Fix this so that we only stop DPRX flow if it has been started in the
> > first place.
> > 
> > Reported-by: Kenneth Crudup <kenny@panix.com>
> > Closes: https://lore.kernel.org/linux-usb/8e175721-806f-45d6-892a-bd3356af80c9@panix.com/
> > Cc: stable@vger.kernel.org
> > Fixes: d6d458d42e1e ("thunderbolt: Handle DisplayPort tunnel activation asynchronously")
> > Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
> > ---
> >  drivers/thunderbolt/tunnel.c | 11 ++++++++---
> >  drivers/thunderbolt/tunnel.h |  2 ++
> >  2 files changed, 10 insertions(+), 3 deletions(-)
> 
> Want me to take this now?  Or are you going to send it on in a later
> pull request to me?  Whichever is easier for you is fine with me.

I will send it later in a pull request, thanks!