kernel/linux.git/drivers/thunderbolt, branch v6.18.21Linux kernel stable tree (mirror)https://git.radix-linux.su/kernel/linux.git/atom?h=v6.18.212025-10-20T06:20:34+00:00thunderbolt: Add support for Intel Wildcat Lake2025-10-20T06:20:34+00:00Alan Borzeszkowskialan.borzeszkowski@linux.intel.com2024-11-14T09:55:44+00:00urn:sha1:3575254546a27210a4b661ea37fbbfb836c0815d
Intel Wildcat Lake derives its Thunderbolt/USB4 controller from Lunar
Lake platform. Add Wildcat Lake PCI ID to the driver list of supported
devices.
Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Fix use-after-free in tb_dp_dprx_work2025-09-23T15:16:38+00:00Duoming Zhouduoming@zju.edu.cn2025-09-23T05:13:57+00:00urn:sha1:67600ccfc4f38ebd331b9332ac94717bfbc87ea7
The original code relies on cancel_delayed_work() in tb_dp_dprx_stop(),
which does not ensure that the delayed work item tunnel->dprx_work has
fully completed if it was already running. This leads to use-after-free
scenarios where tb_tunnel is deallocated by tb_tunnel_put(), while
tunnel->dprx_work remains active and attempts to dereference tb_tunnel
in tb_dp_dprx_work().
A typical race condition is illustrated below:
CPU 0 | CPU 1
tb_dp_tunnel_active() |
tb_deactivate_and_free_tunnel()| tb_dp_dprx_start()
tb_tunnel_deactivate() | queue_delayed_work()
tb_dp_activate() |
tb_dp_dprx_stop() | tb_dp_dprx_work() //delayed worker
cancel_delayed_work() |
tb_tunnel_put(tunnel); |
| tunnel = container_of(...); //UAF
| tunnel-> //UAF
Replacing cancel_delayed_work() with cancel_delayed_work_sync() is
not feasible as it would introduce a deadlock: both tb_dp_dprx_work()
and the cleanup path acquire tb->lock, and cancel_delayed_work_sync()
would wait indefinitely for the work item that cannot proceed.
Instead, implement proper reference counting:
- If cancel_delayed_work() returns true (work is pending), we release
the reference in the stop function.
- If it returns false (work is executing or already completed), the
reference is released in delayed work function itself.
This ensures the tb_tunnel remains valid during work item execution
while preventing memory leaks.
This bug was found by static analysis.
Fixes: d6d458d42e1e ("thunderbolt: Handle DisplayPort tunnel activation asynchronously")
Cc: stable@vger.kernel.org
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Update xdomain.c function documentation2025-09-17T05:33:00+00:00Alan Borzeszkowskialan.borzeszkowski@linux.intel.com2025-08-27T11:56:45+00:00urn:sha1:81a1962cb281636a95c49f02ef57d37deb6ceb8f
Make xdomain.c function documentation compliant with current kernel-doc
standards. No functional changes.
Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Update usb4_port.c function documentation2025-09-17T05:33:00+00:00Alan Borzeszkowskialan.borzeszkowski@linux.intel.com2025-08-27T11:56:44+00:00urn:sha1:a2ba553cd45a5fb33f0edc6dd8c6b5280cad4ab0
Make usb4_port.c function documentation compliant with current kernel-doc
standards. No functional changes.
Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Update usb4.c function documentation2025-09-17T05:33:00+00:00Alan Borzeszkowskialan.borzeszkowski@linux.intel.com2025-08-27T11:56:43+00:00urn:sha1:9a5abaf8be02aeedd8f374b253da472f9eedfbf1
Make usb4.c function documentation compliant with current kernel-doc
standards. No functional changes.
Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Update tunnel.h function documentation2025-09-17T05:33:00+00:00Alan Borzeszkowskialan.borzeszkowski@linux.intel.com2025-08-27T11:56:42+00:00urn:sha1:e262b91b223a237fa87c83ce1b4e4e2dafd053ad
Make tunnel.h function documentation compliant with current kernel-doc
standards. No functional changes.
Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Update tunnel.c function documentation2025-09-17T05:33:00+00:00Alan Borzeszkowskialan.borzeszkowski@linux.intel.com2025-08-27T11:56:41+00:00urn:sha1:6f3ed985b7d1e4950f1f63139f32a7d889e4aaee
Make tunnel.c function documentation compliant with current kernel-doc
standards. No functional changes.
Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Update tmu.c function documentation2025-09-17T05:32:59+00:00Alan Borzeszkowskialan.borzeszkowski@linux.intel.com2025-08-27T11:56:40+00:00urn:sha1:371c2374449db296675a865c46cde54336ff2ef7
Make tmu.c function documentation compliant with current kernel-doc
standards. No functional changes.
Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Add missing documentation in tb.h2025-09-17T05:32:59+00:00Alan Borzeszkowskialan.borzeszkowski@linux.intel.com2025-08-27T11:56:39+00:00urn:sha1:b30234f27396c915547fa5905dcf79e5e9be3ff6
Add missing parameters and struct/enum description in tb.h kernel-doc
comments. No functional changes.
Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Update tb.h function documentation2025-09-17T05:32:59+00:00Alan Borzeszkowskialan.borzeszkowski@linux.intel.com2025-08-27T11:56:38+00:00urn:sha1:978a3d608f9f162ba2f0fa3c392ce8adaa171c95
Make tb.h function documentation compliant with current kernel-doc
standards. No functional changes.
Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>