Public bug reported: [Impact] On Dell systems (CID: 202512-38252) the ethernet port on a Thunderbolt dock stops working after the dock is unplugged and plugged back in, or after a reboot with the dock attached. It does not happen every time.
The USB port code never detaches the Type-C connector when the component is unbound, so the Type-C port keeps a pointer to a USB device that is already freed. UCSI then walks that stale pointer when the PD partner disconnects. This leaves the Thunderbolt tunnel in a bad state, and the dock's igc NIC fails to come up: [ 12.992293] igc 0000:2e:00.0 eth0: PCIe link lost, device now detached [ 12.992986] igc: Failed to read reg 0x0! [ 12.993077] WARNING: CPU: 9 PID: 129 at drivers/net/ethernet/intel/igc/igc_main.c:7005 igc_rd32+0xa4/0xc0 [igc] [ 12.993344] igc_disable_pcie_master+0x16/0xa0 [igc] [ 12.993361] igc_reset_hw_base+0x14/0x170 [igc] [ 12.993376] igc_reset+0x63/0x110 [igc] [ 12.993387] igc_io_slot_reset+0x9e/0xd0 [igc] [ 12.993397] report_slot_reset+0x5d/0xc0 [ 12.993430] pcie_do_recovery+0x209/0x400 [ 12.993439] aer_isr_one_error_type+0x235/0x430 [ 12.993453] aer_isr+0x4e/0x80 [ 12.993461] irq_thread+0xf4/0x1f0 The stale pointer also shows up as a second sysfs link removal: kernfs: can not remove 'typec', no directory WARNING: CPU: 6 PID: 55 at fs/kernfs/dir.c:1706 kernfs_remove_by_name_ns+0xe9/0xf0 Workqueue: events ucsi_handle_connector_change [typec_ucsi] Call Trace: sysfs_remove_link+0x19/0x50 typec_unregister_partner+0x6e/0x120 [typec] ucsi_unregister_partner+0x107/0x150 [typec_ucsi] ucsi_handle_connector_change+0x3ec/0x490 [typec_ucsi] With worse timing the same stale pointer is used after the memory is freed, which is a use-after-free instead of a warning. [Fix] Call typec_deattach() in connector_unbind() before clearing port_dev->connector, so unbind mirrors what connector_bind() does. This clears port->usb2_dev/usb3_dev while the connector is still valid, so UCSI no longer sees a freed USB device. Upstream commit, merged in v7.2-rc5: e0b291fe1179 usb: core: port: Deattach Type-C connector on component unbind Link: https://lore.kernel.org/lkml/[email protected]/ [Test Plan] Attach a Thunderbolt dock with an ethernet port to the system. 1. Unplug and replug the dock 20 times, checking dmesg after each replug: $ sudo dmesg -w | grep -E "igc|typec|kernfs" 2. Or reboot 20 times with the dock attached and check dmesg after boot: $ sudo dmesg | grep -E "PCIe link lost|Failed to read reg|can not remove 'typec'" Also check the dock ethernet actually works after each cycle: $ ip link show $ ping -c 3 <gateway> Without patch: "PCIe link lost, device now detached", "igc: Failed to read reg 0x0!" and the igc_rd32 WARNING show up in dmesg, and the dock ethernet interface does not come up. With patch: no such messages in dmesg, and the dock ethernet interface comes up every time. [Where problems could occur] Could break USB Type-C connector handling in drivers/usb/core/port.c and the typec class. If typec_deattach() is called on a port that was never attached, or the child device is already gone, the Type-C partner sysfs links could be removed too early. That would show up as a missing typec symlink under the USB port, or as "can not remove" warnings from kernfs on dock unplug. Devices that only use the Type-C connector class for USB enumeration, such as USB4/Thunderbolt docks and USB-C monitors, are the ones that would notice. The change is two lines and only runs on the unbind path, so normal enumeration is not affected. ** Affects: hwe-next Importance: Undecided Status: New ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Affects: linux-oem-6.17 (Ubuntu) Importance: Undecided Status: Invalid ** Affects: linux-oem-7.0 (Ubuntu) Importance: Undecided Status: Invalid ** Affects: linux (Ubuntu Noble) Importance: Undecided Status: Invalid ** Affects: linux-oem-6.17 (Ubuntu Noble) Importance: Undecided Assignee: AceLan Kao (acelankao) Status: In Progress ** Affects: linux-oem-7.0 (Ubuntu Noble) Importance: Undecided Assignee: AceLan Kao (acelankao) Status: In Progress ** Affects: linux (Ubuntu Resolute) Importance: Undecided Assignee: AceLan Kao (acelankao) Status: In Progress ** Affects: linux-oem-6.17 (Ubuntu Resolute) Importance: Undecided Status: Invalid ** Affects: linux-oem-7.0 (Ubuntu Resolute) Importance: Undecided Status: Invalid ** Tags: jira-somerville-4224 oem-priority somerville ** Also affects: linux-oem-7.0 (Ubuntu Resolute) Importance: Undecided Status: New ** Also affects: linux-oem-6.17 (Ubuntu) Importance: Undecided Status: New ** Also affects: linux (Ubuntu) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Noble) Importance: Undecided Status: New ** Also affects: linux-oem-6.17 (Ubuntu Noble) Importance: Undecided Status: New ** Also affects: linux-oem-7.0 (Ubuntu Noble) Importance: Undecided Status: New ** Changed in: linux (Ubuntu Noble) Status: New => Invalid ** Changed in: linux (Ubuntu Resolute) Status: New => In Progress ** Changed in: linux-oem-6.17 (Ubuntu Noble) Status: New => In Progress ** Changed in: linux-oem-6.17 (Ubuntu) Status: New => Invalid ** Changed in: linux-oem-6.17 (Ubuntu Resolute) Status: New => Invalid ** Changed in: linux-oem-7.0 (Ubuntu) Status: New => Invalid ** Changed in: linux-oem-7.0 (Ubuntu Noble) Status: New => In Progress ** Changed in: linux-oem-7.0 (Ubuntu Resolute) Status: New => Invalid ** Changed in: linux-oem-7.0 (Ubuntu Noble) Assignee: (unassigned) => AceLan Kao (acelankao) ** Changed in: linux-oem-6.17 (Ubuntu Noble) Assignee: (unassigned) => AceLan Kao (acelankao) ** Changed in: linux (Ubuntu Resolute) Assignee: (unassigned) => AceLan Kao (acelankao) ** Tags added: jira-somerville-4224 oem-priority somerville -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2162704 Title: Dock ethernet stops working after Thunderbolt dock unplug on Dell systems To manage notifications about this bug go to: https://bugs.launchpad.net/hwe-next/+bug/2162704/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
