| From 0f73628e9da1ee39daf5f188190cdbaee5e0c98c Mon Sep 17 00:00:00 2001 |
| From: Sergey Senozhatsky <senozhatsky@chromium.org> |
| Date: Fri, 28 Mar 2025 00:03:50 +0900 |
| Subject: thunderbolt: Do not double dequeue a configuration request |
| |
| From: Sergey Senozhatsky <senozhatsky@chromium.org> |
| |
| commit 0f73628e9da1ee39daf5f188190cdbaee5e0c98c upstream. |
| |
| Some of our devices crash in tb_cfg_request_dequeue(): |
| |
| general protection fault, probably for non-canonical address 0xdead000000000122 |
| |
| CPU: 6 PID: 91007 Comm: kworker/6:2 Tainted: G U W 6.6.65 |
| RIP: 0010:tb_cfg_request_dequeue+0x2d/0xa0 |
| Call Trace: |
| <TASK> |
| ? tb_cfg_request_dequeue+0x2d/0xa0 |
| tb_cfg_request_work+0x33/0x80 |
| worker_thread+0x386/0x8f0 |
| kthread+0xed/0x110 |
| ret_from_fork+0x38/0x50 |
| ret_from_fork_asm+0x1b/0x30 |
| |
| The circumstances are unclear, however, the theory is that |
| tb_cfg_request_work() can be scheduled twice for a request: |
| first time via frame.callback from ring_work() and second |
| time from tb_cfg_request(). Both times kworkers will execute |
| tb_cfg_request_dequeue(), which results in double list_del() |
| from the ctl->request_queue (the list poison deference hints |
| at it: 0xdead000000000122). |
| |
| Do not dequeue requests that don't have TB_CFG_REQUEST_ACTIVE |
| bit set. |
| |
| Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org> |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/thunderbolt/ctl.c | 5 +++++ |
| 1 file changed, 5 insertions(+) |
| |
| --- a/drivers/thunderbolt/ctl.c |
| +++ b/drivers/thunderbolt/ctl.c |
| @@ -151,6 +151,11 @@ static void tb_cfg_request_dequeue(struc |
| struct tb_ctl *ctl = req->ctl; |
| |
| mutex_lock(&ctl->request_queue_lock); |
| + if (!test_bit(TB_CFG_REQUEST_ACTIVE, &req->flags)) { |
| + mutex_unlock(&ctl->request_queue_lock); |
| + return; |
| + } |
| + |
| list_del(&req->list); |
| clear_bit(TB_CFG_REQUEST_ACTIVE, &req->flags); |
| if (test_bit(TB_CFG_REQUEST_CANCELED, &req->flags)) |
