Re: [PATCH] thunderbolt: Prevent use-after-free in resume from hibernate

[Mika Westerberg <mika.westerberg@linux.intel.com>]

On Thu, Mar 06, 2025 at 12:29:14PM +0200, Yehezkel Bernat wrote:
> On Thu, Mar 6, 2025 at 10:41 AM Mika Westerberg
> <mika.westerberg@linux.intel.com> wrote:
> >
> > Kenneth noticed that his laptop crashes randomly when resuming from
> > hibernate if there is device connected and display tunneled. I was able
> > to reproduce this as well with the following steps:
> >
> >   1. Boot the system up, nothing connected.
> >   2. Connect Thunderbolt 4 dock to the host.
> >   3. Connect monitor to the Thunderbolt 4 dock.
> >   4. Verify that there is picture on the screen.
> >   5. Enter hibernate.
> >   6. Exit hibernate.
> >   7. Wait for the system to resume.
> >
> >   Expectation: System resumes just fine, the connected monitor still
> >                shows screen.
> >   Actual result: There is crash during resume, screen is blank.
> >
> > What happens is that during resume from hibernate we tear down any
> > existing tunnels created by the boot kernel and this ends up calling
> > tb_dp_dprx_stop() which calls tb_tunnel_put() dropping the reference
> > count to zero even though we never called tb_dp_dprx_start() for it (we
> > never do that for discovery). This makes the discovered DP tunnel memory
> > to be released and any access after that causes use-after-free and
> > possible crash.
> >
> > Fix this so that we only stop DPRX flow if it has been started in the
> > first place.
> >
> > Reported-by: Kenneth Crudup <kenny@panix.com>
> > Closes: https://lore.kernel.org/linux-usb/8e175721-806f-45d6-892a-bd3356af80c9@panix.com/
> > Cc: stable@vger.kernel.org
> > Fixes: d6d458d42e1e ("thunderbolt: Handle DisplayPort tunnel activation asynchronously")
> > Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
> > ---
> 
> Reviewed-by: Yehezkel Bernat <YehezkelShB@gmail.com>

Thanks! Applied to thunderbolt.git/fixes.