Commit ac00bc2a authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

Merge tag 'thunderbolt-for-v6.14-rc7' of... 

Merge tag 'thunderbolt-for-v6.14-rc7' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus

Mika writes:

thunderbolt: Fix for v6.14-rc7

This includes single USB4/Thunderbolt fix for v6.14-rc7:

  - Fix use-after-free in resume from hibernate.

This has been in linux-next with no reported issues.

* tag 'thunderbolt-for-v6.14-rc7' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt:
  thunderbolt: Prevent use-after-free in resume from hibernate
parents 80e54e84 50284339

drivers/thunderbolt/tunnel.c

+8 −3
Original line number Diff line number Diff line
@@ -1009,6 +1009,8 @@ static int tb_dp_dprx_start(struct tb_tunnel *tunnel) 
	 */

	tb_tunnel_get(tunnel);



	tunnel->dprx_started = true;



	if (tunnel->callback) {

		tunnel->dprx_timeout = dprx_timeout_to_ktime(dprx_timeout);

		queue_delayed_work(tunnel->tb->wq, &tunnel->dprx_work, 0);
@@ -1021,10 +1023,13 @@ static int tb_dp_dprx_start(struct tb_tunnel *tunnel) 


static void tb_dp_dprx_stop(struct tb_tunnel *tunnel)

{

	if (tunnel->dprx_started) {

		tunnel->dprx_started = false;

		tunnel->dprx_canceled = true;

		cancel_delayed_work(&tunnel->dprx_work);

		tb_tunnel_put(tunnel);

	}

}



static int tb_dp_activate(struct tb_tunnel *tunnel, bool active)

{

drivers/thunderbolt/tunnel.h

+2 −0
Original line number Diff line number Diff line
@@ -63,6 +63,7 @@ enum tb_tunnel_state { 
 * @allocated_down: Allocated downstream bandwidth (only for USB3)

 * @bw_mode: DP bandwidth allocation mode registers can be used to

 *	     determine consumed and allocated bandwidth

 * @dprx_started: DPRX negotiation was started (tb_dp_dprx_start() was called for it)

 * @dprx_canceled: Was DPRX capabilities read poll canceled

 * @dprx_timeout: If set DPRX capabilities read poll work will timeout after this passes

 * @dprx_work: Worker that is scheduled to poll completion of DPRX capabilities read
@@ -100,6 +101,7 @@ struct tb_tunnel { 
	int allocated_up;

	int allocated_down;

	bool bw_mode;

	bool dprx_started;

	bool dprx_canceled;

	ktime_t dprx_timeout;

	struct delayed_work dprx_work;