mirror of https://github.com/torvalds/linux.git
67600ccfc4
The original code relies on cancel_delayed_work() in tb_dp_dprx_stop(),
which does not ensure that the delayed work item tunnel->dprx_work has
fully completed if it was already running. This leads to use-after-free
scenarios where tb_tunnel is deallocated by tb_tunnel_put(), while
tunnel->dprx_work remains active and attempts to dereference tb_tunnel
in tb_dp_dprx_work().
A typical race condition is illustrated below:
CPU 0 | CPU 1
tb_dp_tunnel_active() |
tb_deactivate_and_free_tunnel()| tb_dp_dprx_start()
tb_tunnel_deactivate() | queue_delayed_work()
tb_dp_activate() |
tb_dp_dprx_stop() | tb_dp_dprx_work() //delayed worker
cancel_delayed_work() |
tb_tunnel_put(tunnel); |
| tunnel = container_of(...); //UAF
| tunnel-> //UAF
Replacing cancel_delayed_work() with cancel_delayed_work_sync() is
not feasible as it would introduce a deadlock: both tb_dp_dprx_work()
and the cleanup path acquire tb->lock, and cancel_delayed_work_sync()
would wait indefinitely for the work item that cannot proceed.
Instead, implement proper reference counting:
- If cancel_delayed_work() returns true (work is pending), we release
the reference in the stop function.
- If it returns false (work is executing or already completed), the
reference is released in delayed work function itself.
This ensures the tb_tunnel remains valid during work item execution
while preventing memory leaks.
This bug was found by static analysis.
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| acpi.c | ||
| cap.c | ||
| clx.c | ||
| ctl.c | ||
| ctl.h | ||
| debugfs.c | ||
| dma_port.c | ||
| dma_port.h | ||
| dma_test.c | ||
| domain.c | ||
| eeprom.c | ||
| icm.c | ||
| lc.c | ||
| nhi.c | ||
| nhi.h | ||
| nhi_ops.c | ||
| nhi_regs.h | ||
| nvm.c | ||
| path.c | ||
| property.c | ||
| quirks.c | ||
| retimer.c | ||
| sb_regs.h | ||
| switch.c | ||
| tb.c | ||
| tb.h | ||
| tb_msgs.h | ||
| tb_regs.h | ||
| test.c | ||
| tmu.c | ||
| trace.h | ||
| tunnel.c | ||
| tunnel.h | ||
| usb4.c | ||
| usb4_port.c | ||
| xdomain.c | ||