Re: [PATCH] thunderbolt: Prevent use-after-free in resume from hibernate

[Greg KH <gregkh@linuxfoundation.org>]

On Thu, Mar 06, 2025 at 10:41:45AM +0200, Mika Westerberg wrote:
> Kenneth noticed that his laptop crashes randomly when resuming from
> hibernate if there is device connected and display tunneled. I was able
> to reproduce this as well with the following steps:
> 
>   1. Boot the system up, nothing connected.
>   2. Connect Thunderbolt 4 dock to the host.
>   3. Connect monitor to the Thunderbolt 4 dock.
>   4. Verify that there is picture on the screen.
>   5. Enter hibernate.
>   6. Exit hibernate.
>   7. Wait for the system to resume.
> 
>   Expectation: System resumes just fine, the connected monitor still
>                shows screen.
>   Actual result: There is crash during resume, screen is blank.
> 
> What happens is that during resume from hibernate we tear down any
> existing tunnels created by the boot kernel and this ends up calling
> tb_dp_dprx_stop() which calls tb_tunnel_put() dropping the reference
> count to zero even though we never called tb_dp_dprx_start() for it (we
> never do that for discovery). This makes the discovered DP tunnel memory
> to be released and any access after that causes use-after-free and
> possible crash.
> 
> Fix this so that we only stop DPRX flow if it has been started in the
> first place.
> 
> Reported-by: Kenneth Crudup <kenny@panix.com>
> Closes: https://lore.kernel.org/linux-usb/8e175721-806f-45d6-892a-bd3356af80c9@panix.com/
> Cc: stable@vger.kernel.org
> Fixes: d6d458d42e1e ("thunderbolt: Handle DisplayPort tunnel activation asynchronously")
> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
> ---
>  drivers/thunderbolt/tunnel.c | 11 ++++++++---
>  drivers/thunderbolt/tunnel.h |  2 ++
>  2 files changed, 10 insertions(+), 3 deletions(-)

Want me to take this now?  Or are you going to send it on in a later
pull request to me?  Whichever is easier for you is fine with me.

thanks,

greg k-h