Re: [PATCH 1/2] thunderbolt: Do not match XDomain responses to received packets

[sashiko-bot@kernel.org]

> What happens is that __tb_xdomain_response() queues a request that has
> no response buffer. tb_cfg_request() schedules its work right after
> sending it, and the request stays on ctl->request_queue until that work
> dequeues it.
> 
> Until then tb_xdomain_match() can match a received error packet, or an
> XDomain response with the same route and UUID, to this request. The
> packet may really belong to a tb_xdomain_request() queued behind it.
> tb_ctl_rx_callback() then calls schedule_work() again. If the first run
> has already started, the work runs a second time after the request has
> been released:
> 
>   refcount_t: underflow; use-after-free.
>   WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x59/0x90
>   Workqueue: events tb_cfg_request_work [thunderbolt]
> [ ... ]
> The analysis, the fix and the tests were done with an AI coding assistant.
> 
> Fixes: d1ff70241a27 ("thunderbolt: Add support for XDomain discovery protocol")
> Cc: stable@vger.kernel.org
> Signed-off-by: Sven Neuhaus <sven-kernel@sven.de>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/1794520303-5758-1-git-send-email-sven-kernel@sven.de?part=1