[PATCH] fix: drivers/thunderbolt: tb_tunnel_pci: missing tb_tunnel_put on success path

[PATCH] fix: drivers/thunderbolt: tb_tunnel_pci: missing tb_tunnel_put on success path

[WenTao Liang]

In tb_tunnel_pci(), tb_tunnel_alloc_pci() allocates a tunnel with kref
initialized to 1. On the success path, the tunnel is added to the tunnel
list via list_add_tail() but tb_tunnel_put() is never called to release
the initial reference. On the error path (tb_tunnel_activate failure),
tb_tunnel_put() is correctly called.

Add tb_tunnel_put(tunnel) after list_add_tail() on the success path.

Cc: stable@vger.kernel.org
Fixes: 99cabbb006f1 ("thunderbolt: Add support for full PCIe daisy chains")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
 drivers/thunderbolt/tb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
index c69c323e6952..57c9839b133f 100644
--- a/drivers/thunderbolt/tb.c
+++ b/drivers/thunderbolt/tb.c
@@ -2313,6 +2313,7 @@ static int tb_tunnel_pci(struct tb *tb, struct tb_switch *sw)
 		tb_sw_warn(sw, "failed to connect xHCI\n");
 
 	list_add_tail(&tunnel->list, &tcm->tunnel_list);
+	tb_tunnel_put(tunnel);
 	return 0;
 }
 
-- 
2.39.5 (Apple Git-154)

Re: [PATCH] fix: drivers/thunderbolt: tb_tunnel_pci: missing tb_tunnel_put on success path

[Mika Westerberg]

Your $subject is not following the conventions. Look at the existing
commits in given subsystem to see how they should look like. Here we like
"thunderbolt: ...".

On Sat, Jun 27, 2026 at 10:46:40AM +0800, WenTao Liang wrote:
> In tb_tunnel_pci(), tb_tunnel_alloc_pci() allocates a tunnel with kref
> initialized to 1. On the success path, the tunnel is added to the tunnel
> list via list_add_tail() but tb_tunnel_put() is never called to release
> the initial reference. On the error path (tb_tunnel_activate failure),
> tb_tunnel_put() is correctly called.
> 
> Add tb_tunnel_put(tunnel) after list_add_tail() on the success path.
> 
> Cc: stable@vger.kernel.org
> Fixes: 99cabbb006f1 ("thunderbolt: Add support for full PCIe daisy chains")

This is wrong commit.

> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/thunderbolt/tb.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
> index c69c323e6952..57c9839b133f 100644
> --- a/drivers/thunderbolt/tb.c
> +++ b/drivers/thunderbolt/tb.c
> @@ -2313,6 +2313,7 @@ static int tb_tunnel_pci(struct tb *tb, struct tb_switch *sw)
>  		tb_sw_warn(sw, "failed to connect xHCI\n");
>  
>  	list_add_tail(&tunnel->list, &tcm->tunnel_list);
> +	tb_tunnel_put(tunnel);

This will release the tunnel once it is in the list e.g causing
use-after-free later.

>  	return 0;
>  }
>  
> -- 
> 2.39.5 (Apple Git-154)