Mika Westerberg b92738c4f9 thunderbolt: Fix use-after-free in remove_unplugged_switch() ... commit 600c0849cf upstream. Paulian reported a crash that happens when a dock is unplugged during hibernation: [78436.228217] thunderbolt 0-1: device disconnected [78436.228365] BUG: kernel NULL pointer dereference, address: 00000000000001e0 ... [78436.228397] RIP: 0010:icm_free_unplugged_children+0x109/0x1a0 ... [78436.228432] Call Trace: [78436.228439] icm_rescan_work+0x24/0x30 [78436.228444] process_one_work+0x1a3/0x3a0 [78436.228449] worker_thread+0x30/0x370 [78436.228454] ? process_one_work+0x3a0/0x3a0 [78436.228457] kthread+0x13d/0x160 [78436.228461] ? kthread_park+0x90/0x90 [78436.228465] ret_from_fork+0x1f/0x30 This happens because remove_unplugged_switch() calls tb_switch_remove() that releases the memory pointed by sw so the following lines reference to a memory that might be released already. Fix this by saving pointer to the parent device before calling tb_switch_remove(). Reported-by: Paulian Bogdan Marinca <paulian@marinca.net> Fixes: 4f7c2e0d87 ("thunderbolt: Make sure device runtime resume completes before taking domain lock") Cc: stable@vger.kernel.org Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-12-11 13:23:29 +01:00
..
Kconfig	…
Makefile	…
cap.c	…
ctl.c	…
ctl.h	…
dma_port.c	…
dma_port.h	…
domain.c	…
eeprom.c	…
icm.c	thunderbolt: Fix use-after-free in remove_unplugged_switch()	2020-12-11 13:23:29 +01:00
lc.c	…
nhi.c	…
nhi.h	…
nhi_ops.c	…
nhi_regs.h	…
path.c	…
property.c	…
switch.c	…
tb.c	…
tb.h	…
tb_msgs.h	…
tb_regs.h	…
tunnel.c	…
tunnel.h	…
xdomain.c	…