On Thu, Mar 06, 2025 at 04:45:22PM +0100, Greg KH wrote: > On Thu, Mar 06, 2025 at 10:41:45AM +0200, Mika Westerberg wrote: > > Kenneth noticed that his laptop crashes randomly when resuming from > > hibernate if there is device connected and display tunneled. I was able > > to reproduce this as well with the following steps: > > > > 1. Boot the system up, nothing connected. > > 2. Connect Thunderbolt 4 dock to the host. > > 3. Connect monitor to the Thunderbolt 4 dock. > > 4. Verify that there is picture on the screen. > > 5. Enter hibernate. > > 6. Exit hibernate. > > 7. Wait for the system to resume. > > > > Expectation: System resumes just fine, the connected monitor still > > shows screen. > > Actual result: There is crash during resume, screen is blank. > > > > What happens is that during resume from hibernate we tear down any > > existing tunnels created by the boot kernel and this ends up calling > > tb_dp_dprx_stop() which calls tb_tunnel_put() dropping the reference > > count to zero even though we never called tb_dp_dprx_start() for it (we > > never do that for discovery). This makes the discovered DP tunnel memory > > to be released and any access after that causes use-after-free and > > possible crash. > > > > Fix this so that we only stop DPRX flow if it has been started in the > > first place. > > > > Reported-by: Kenneth Crudup <kenny@xxxxxxxxx> > > Closes: https://lore.kernel.org/linux-usb/8e175721-806f-45d6-892a-bd3356af80c9@xxxxxxxxx/ > > Cc: stable@xxxxxxxxxxxxxxx > > Fixes: d6d458d42e1e ("thunderbolt: Handle DisplayPort tunnel activation asynchronously") > > Signed-off-by: Mika Westerberg <mika.westerberg@xxxxxxxxxxxxxxx> > > --- > > drivers/thunderbolt/tunnel.c | 11 ++++++++--- > > drivers/thunderbolt/tunnel.h | 2 ++ > > 2 files changed, 10 insertions(+), 3 deletions(-) > > Want me to take this now? Or are you going to send it on in a later > pull request to me? Whichever is easier for you is fine with me. I will send it later in a pull request, thanks!
