linux/drivers/thunderbolt
Mika Westerberg 600c0849cf thunderbolt: Fix use-after-free in remove_unplugged_switch()
Paulian reported a crash that happens when a dock is unplugged during
hibernation:

[78436.228217] thunderbolt 0-1: device disconnected
[78436.228365] BUG: kernel NULL pointer dereference, address: 00000000000001e0
...
[78436.228397] RIP: 0010:icm_free_unplugged_children+0x109/0x1a0
...
[78436.228432] Call Trace:
[78436.228439]  icm_rescan_work+0x24/0x30
[78436.228444]  process_one_work+0x1a3/0x3a0
[78436.228449]  worker_thread+0x30/0x370
[78436.228454]  ? process_one_work+0x3a0/0x3a0
[78436.228457]  kthread+0x13d/0x160
[78436.228461]  ? kthread_park+0x90/0x90
[78436.228465]  ret_from_fork+0x1f/0x30

This happens because remove_unplugged_switch() calls tb_switch_remove()
that releases the memory pointed by sw so the following lines reference
to a memory that might be released already.

Fix this by saving pointer to the parent device before calling
tb_switch_remove().

Reported-by: Paulian Bogdan Marinca <paulian@marinca.net>
Fixes: 4f7c2e0d87 ("thunderbolt: Make sure device runtime resume completes before taking domain lock")
Cc: stable@vger.kernel.org
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-19 17:44:10 +03:00
..
acpi.c thunderbolt: Create device links from ACPI description 2020-09-03 12:06:42 +03:00
cap.c thunderbolt: Introduce tb_switch_next_cap() 2020-09-03 12:21:07 +03:00
ctl.c thunderbolt: Log correct zeroX entries in decode_error() 2020-09-16 14:57:46 +03:00
ctl.h thunderbolt: Populate PG field in hot plug acknowledgment packet 2019-12-18 15:34:25 +01:00
debugfs.c thunderbolt: Add uaccess dependency to debugfs interface 2020-11-05 13:32:46 +03:00
dma_port.c thunderbolt: Convert rest of the driver files to use SPDX identifier 2018-10-02 15:52:08 -07:00
dma_port.h thunderbolt: Convert rest of the driver files to use SPDX identifier 2018-10-02 15:52:08 -07:00
domain.c thunderbolt: Allow KUnit tests to be built also when CONFIG_USB4=m 2020-09-16 14:57:46 +03:00
eeprom.c thunderbolt: Retry DROM read once if parsing fails 2020-09-09 14:00:56 +03:00
icm.c thunderbolt: Fix use-after-free in remove_unplugged_switch() 2020-11-19 17:44:10 +03:00
Kconfig thunderbolt: Use "if USB4" instead of "depends on" in Kconfig 2020-09-16 14:57:46 +03:00
lc.c thunderbolt: Enable wakes from system suspend 2020-09-03 12:06:42 +03:00
Makefile thunderbolt: Allow KUnit tests to be built also when CONFIG_USB4=m 2020-09-16 14:57:46 +03:00
nhi_ops.c thunderbolt: Software CM only should set force power in Tiger Lake 2020-09-03 12:06:40 +03:00
nhi_regs.h thunderbolt: Add support for Intel Ice Lake 2019-08-26 12:15:06 +03:00
nhi.c thunderbolt: Add support for Intel Tiger Lake-H 2020-11-06 16:39:11 +03:00
nhi.h thunderbolt: Add support for Intel Tiger Lake-H 2020-11-06 16:39:11 +03:00
nvm.c thunderbolt: Add support for separating the flush to SPI and authenticate 2020-07-01 13:51:49 +03:00
path.c thunderbolt: Add USB3 bandwidth management 2020-06-22 19:58:20 +03:00
property.c thunderbolt: property: Fix a missing check of kzalloc 2019-03-28 11:30:47 +03:00
quirks.c thunderbolt: Correct tb_check_quirks() kernel-doc 2020-09-16 14:57:46 +03:00
retimer.c thunderbolt: Add support for on-board retimers 2020-06-22 19:58:32 +03:00
sb_regs.h thunderbolt: Add support for on-board retimers 2020-06-22 19:58:32 +03:00
switch.c thunderbolt: Changes for v5.10 merge window 2020-09-30 09:42:36 +02:00
tb_msgs.h thunderbolt: Handle ERR_LOCK notification 2020-09-16 14:57:46 +03:00
tb_regs.h thunderbolt: Add debugfs interface 2020-09-03 12:21:08 +03:00
tb.c thunderbolt: Only stop control channel when entering freeze 2020-09-16 14:57:46 +03:00
tb.h thunderbolt: Add support for Intel Tiger Lake-H 2020-11-06 16:39:11 +03:00
test.c thunderbolt: Allow KUnit tests to be built also when CONFIG_USB4=m 2020-09-16 14:57:46 +03:00
tmu.c thunderbolt: Add support for Time Management Unit 2019-12-18 15:41:15 +01:00
tunnel.c thunderbolt: Fixes for v5.9-rc4 2020-09-01 09:48:28 +02:00
tunnel.h thunderbolt: Add USB3 bandwidth management 2020-06-22 19:58:20 +03:00
usb4.c thunderbolt: Only configure USB4 wake for lane 0 adapters 2020-11-05 13:32:53 +03:00
xdomain.c thunderbolt: Fix memory leak if ida_simple_get() fails in enumerate_services() 2020-11-05 13:32:40 +03:00