Public bug reported:
[Impact]
The oem-7.0 thunderbolt driver is based on an older tree. Upstream heavily
refactored the driver in v7.2-rc1 (NHI struct split, XDomain lifetime and
locking rework, path/tunnel allocation changes, plus new USB4STREAM and
ConfigFS support). The v7.1 line also carries XDomain property-parser
hardening that prevents out-of-bounds reads on malformed XDomain property
data (Fixes: cdae7...).
If we don't sync the driver first, every future fix we need to backport from
v7.2-rc1 or later (security hardening, device quirks, stability fixes) will
fail to apply or will conflict badly against the old tree. Backporting the
whole refactor now keeps the driver aligned with upstream so later fixes land
cleanly.
This batch also closes a real gap: without the v7.1 XDomain bounds-check
commits, a peer sending oversized or malformed property packets can trigger
out-of-bounds reads in tb_property_parse_dir() and the XDomain response copy
paths.
[Fix]
Preemptively backport the thunderbolt refactor plus hardening that landed in
v7.1 and v7.2-rc1.
Scope: 50 commits total.
- 47 are direct upstream backports (10 from v7.1, 37 from v7.2-rc1).
- 3 are local adjustments needed to land the series on this tree:
* UBUNTU: [Config] Add annotations USB4_{STREAM,CONFIGFS}
(enables the two new features; USB4_STREAM=n, USB4_CONFIGFS=m)
* UBUNTU: SAUCE: thunderbolt: Fix tb_pci_rescan_work after Move pci_device
out of tb_nhi (fixes a reference broken by the NHI struct move)
* thunderbolt: Add tb_property_merge_dir() (backported with a forward-
declaration conflict resolved against this tree's "Cap recursion depth"
change; marked (backported from commit ...) instead of cherry-picked)
Key structural upstream changes (all from v7.2-rc1 unless noted):
- NHI: Move pci_device out of tb_nhi, Separate out common NHI bits,
Require nhi->ops be valid, more descriptive probe errors.
- XDomain lifetime/locking: remove from bus without holding tb->lock, keep
XDomain reference during a service, add xd->removing guard for delayed work
(use-after-free fix), keep domain reference during hotplug.
- Path/tunnel: Activate path hops source->destination, tunnel allocation
simplification, kzalloc_flex() for tb_path, dma_port flex alloc, improve
multi-display DP tunnel allocation.
- Router/probe: Read NVM version before quirks, verify Router Ready / Config
Ready bits, increase notification + config-ready timeouts, verify PCIe
adapter detect state, lane-bonding logging and USB4 v2 bonding fixes.
- New features: USB4STREAM, ConfigFS, tb_ring_flush(), service-driver
interrupt throttling + own properties.
- Hardening (v7.1): validate XDomain request packet size, clamp/limit
response copy, bound root directory to block size, reject zero-length
property entries.
- CLx: disable CLx on Titan Ridge devices with old firmware (v7.1).
Upstream versions confirmed via `git tag --contains <hash>`:
v7.1 for the 10 hardening/flex/CLx commits
v7.2-rc1 for the 37 refactor/feature commits
No Launchpad bug is attached yet; this is a proactive driver sync. A tracking
bug should be opened for the SRU.
[Test Plan]
Build the kernel with the new config and verify basic + stressed thunderbolt
behavior on a TB3/TB4 capable machine.
1) Build and install; confirm the new options took:
$ grep -E 'CONFIG_USB4_(STREAM|CONFIGFS)' /boot/config-$(uname -r)
Expect CONFIG_USB4_CONFIGFS=m and CONFIG_USB4_STREAM not set.
2) Cold boot, check the controller enumerates with no errors:
$ sudo dmesg | grep -i thunderbolt
Expect clean "thunderbolt ... detected" / router enumeration; no WARN/OOPS.
3) Hotplug a Thunderbolt dock/device, then unplug:
$ boltctl list
$ sudo dmesg | tail
Expect the device to appear on plug and disappear on unplug; no kernel
error. Repeat plug/unplug 10 times.
4) Connect an external display through the dock (DP tunnel):
Expect the display to come up; no "failed to activate path" in dmesg.
5) Suspend/resume with a device plugged:
$ sudo rtcwake -m mem -s 20
After resume, boltctl list should still show the device; no oops.
6) (If two TB hosts available) thunderbolt-net:
$ sudo modprobe thunderbolt-net
Bring up the link and ping across; no crash in tb_service / XDomain paths.
Without the series: future v7.2-rc1+ fixes can't be cleanly backported; the
v7.1 XDomain parser hardening is also missing (OOB-read exposure). With the
series: driver enumerates, tunnels, hotplugs, suspends, and networks as above.
[Where problems could occur]
This touches core thunderbolt driver structures, so a regression would show up
in the thunderbolt driver itself.
- NHI rework (Move pci_device out of tb_nhi, common NHI bits, require
nhi->ops): if pdev/ops handling is wrong, the driver may fail to probe on
some controllers, or tb_pci_rescan_work could deref a stale pointer. dmesg
would show a probe failure or NULL deref.
- XDomain lifetime/locking (xd->removing, ref during service, remove without
tb->lock): if reference counting or the lock guard is wrong, a device
disconnect could hit a use-after-free or hang the workqueue. thunderbolt-net
and service-based tunnels are the most exposed.
- Path/tunnel allocation (kzalloc_flex, allocation simplification, activate
hops src->dst): a mistake could fail DP or PCIe tunnel setup ("failed to
activate path") or misconfigure hop credits.
- CLx on Titan Ridge (v7.1): if the firmware-version condition is inverted,
CLx could stay disabled (lower power savings) or get enabled on old firmware
and break router enumeration.
- USB4STREAM / ConfigFS (new, off by default except ConfigFS=m): if the new
module teardown is wrong, rmmod thunderbolt or configfs unmount could oops.
- Suspend/resume (tb_domain_release wait, root_switch = NULL on stop): if
wrong, resume could hang or oops during domain teardown.
[Other Info]
- This is a proactive driver sync, not a fix for a single reported failure.
- Targets oem-7.0 (Resolute 26.04) only.
- 47 commits are upstream (v7.1 / v7.2-rc1); 3 are local (config, SAUCE NHI
fixup, manually resolved tb_property_merge_dir backport).
- The v7.2-rc1 refactor is the same code that will be in the 7.2 stable
kernel; this keeps oem-7.0 aligned so later stable fixes apply cleanly.
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Affects: linux-oem-7.0 (Ubuntu)
Importance: Undecided
Status: New
** Affects: linux (Ubuntu Resolute)
Importance: Undecided
Status: Won't Fix
** Affects: linux-oem-7.0 (Ubuntu Resolute)
Importance: Undecided
Assignee: AceLan Kao (acelankao)
Status: In Progress
** Also affects: linux-oem-7.0 (Ubuntu)
Importance: Undecided
Status: New
** Also affects: linux (Ubuntu Resolute)
Importance: Undecided
Status: New
** Also affects: linux-oem-7.0 (Ubuntu Resolute)
Importance: Undecided
Status: New
** Changed in: linux-oem-7.0 (Ubuntu Resolute)
Status: New => In Progress
** Changed in: linux (Ubuntu Resolute)
Status: New => Won't Fix
** Changed in: linux-oem-7.0 (Ubuntu Resolute)
Assignee: (unassigned) => AceLan Kao (acelankao)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2160699
Title:
Thunderbolt: pre-backport v7.2-rc1 refactor to oem-7.0 to avoid future
conflicts
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2160699/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
