Sergey Senozhatsky
e49e994cd8
thunderbolt: Do not double dequeue a configuration request ...
commit 0f73628e9da1ee39daf5f188190cdbaee5e0c98c upstream.
Some of our devices crash in tb_cfg_request_dequeue():
general protection fault, probably for non-canonical address 0xdead000000000122
CPU: 6 PID: 91007 Comm: kworker/6:2 Tainted: G U W 6.6.65
RIP: 0010:tb_cfg_request_dequeue+0x2d/0xa0
Call Trace:
<TASK>
? tb_cfg_request_dequeue+0x2d/0xa0
tb_cfg_request_work+0x33/0x80
worker_thread+0x386/0x8f0
kthread+0xed/0x110
ret_from_fork+0x38/0x50
ret_from_fork_asm+0x1b/0x30
The circumstances are unclear, however, the theory is that
tb_cfg_request_work() can be scheduled twice for a request:
first time via frame.callback from ring_work() and second
time from tb_cfg_request(). Both times kworkers will execute
tb_cfg_request_dequeue(), which results in double list_del()
from the ctl->request_queue (the list poison deference hints
at it: 0xdead000000000122).
Do not dequeue requests that don't have TB_CFG_REQUEST_ACTIVE
bit set.
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-06-27 11:02:44 +01:00
ACPI: HED: Always initialize before evged
2025-06-04 14:32:33 +02:00
ahci: add PCI ID for Marvell 88SE9215 SATA Controller
2025-05-02 07:39:10 +02:00
PM: sleep: Fix handling devices with direct_complete set on errors
2025-04-10 14:29:40 +02:00
nbd: don't allow reconnect after disconnect
2025-03-13 12:42:52 +01:00
Bluetooth: btrtl: Prevent potential NULL dereference
2025-05-02 07:39:19 +02:00
virtio_console: fix missing byte order handling for cols and rows
2025-05-02 07:39:26 +02:00
clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec()
2025-05-02 07:39:28 +02:00
clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable()
2025-06-04 14:32:29 +02:00
counter: stm32-lptimer-cnt: fix error handling when enabling
2025-04-10 14:29:39 +02:00
cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
2025-05-02 07:39:25 +02:00
cpuidle: menu: Avoid discarding useful information
2025-06-04 14:32:32 +02:00
crypto: atmel-sha204a - Set hwrng quality to lowest possible
2025-05-02 07:39:30 +02:00
dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted"
2025-06-04 14:32:29 +02:00
udmabuf: fix a buf size overflow issue during udmabuf creation
2025-05-02 07:39:29 +02:00
EDAC/ie31200: work around false positive build warning
2025-06-04 14:32:33 +02:00
firmware: imx-scu: fix OF node leak in .probe()
2025-04-10 14:29:37 +02:00
fpga: altera-cvp: Increase credit timeout
2025-06-04 14:32:32 +02:00
gpio: zynq: Fix wakeup source leaks on device unbind
2025-05-02 07:39:17 +02:00
drm/i915/gvt: fix unterminated-string-initialization warning
2025-06-04 14:32:36 +02:00
HID: quirks: Add ADATA XPG alpha wireless mouse support
2025-06-04 14:32:37 +02:00
HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
2025-05-02 07:39:18 +02:00
Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio()
2025-04-10 14:29:35 +02:00
hwmon: (xgene-hwmon) use appropriate type for the latency value
2025-06-04 14:32:34 +02:00
coresight: catu: Fix number of pages while using 64k pages
2025-04-10 14:29:41 +02:00
i2c: pxa: fix call balance of i2c->clk handling routines
2025-06-04 14:32:30 +02:00
i3c: Add NULL pointer check in i3c_master_queue_ibi()
2025-05-02 07:39:15 +02:00
iio: chemical: sps30: use aligned_s64 for timestamp
2025-06-04 14:32:28 +02:00
RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
2025-06-04 14:32:28 +02:00
Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5
2025-06-04 14:32:29 +02:00
iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
2025-06-04 14:32:26 +02:00
irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
2025-06-04 14:32:25 +02:00
leds: lp8860: Write full EEPROM, not only half of it
2025-03-13 12:43:06 +01:00
mailbox: use error ret code of of_parse_phandle_with_args()
2025-06-04 14:32:30 +02:00
mcb: fix a double free bug in chameleon_parse_gdd()
2025-05-02 07:39:26 +02:00
dm cache: prevent BUG_ON by blocking retries on failed device resumes
2025-06-04 14:32:31 +02:00
media: cx231xx: set device_caps for 417
2025-06-04 14:32:32 +02:00
memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
2025-04-10 14:29:39 +02:00
scsi: fusion: Remove unused variable 'rc'
2024-12-14 19:44:29 +01:00
mfd: sm501: Switch to BIT() to mitigate integer overflows
2025-04-10 14:29:41 +02:00
misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error
2025-05-02 07:39:25 +02:00
mmc: sdhci: Disable SD card clock before changing parameters
2025-06-04 14:32:31 +02:00
mtd: rawnand: Add status chack in r852_ready()
2025-05-02 07:39:16 +02:00
net: dwmac-sun8i: Use parsed internal PHY address instead of 1
2025-06-04 14:32:35 +02:00
ntb: reduce stack usage in idt_scan_mws
2025-05-02 07:39:28 +02:00
libnvdimm/labels: Fix divide error in nd_label_data_init()
2025-06-04 14:32:30 +02:00
nvmet-tcp: don't restore null sk_state_change
2025-06-04 14:32:35 +02:00
nvmem: core: improve range check for nvmem_cell_write()
2025-03-13 12:43:10 +01:00
of: module: add buffer overflow check in of_modalias()
2025-06-04 14:32:25 +02:00
parport_pc: add support for ASIX AX99100
2025-03-13 12:43:19 +01:00
PCI: Fix old_size lower bound in calculate_iosize() too
2025-06-04 14:32:33 +02:00
perf: arm_pmu: Don't disable counter in armpmu_add()
2025-05-02 07:39:09 +02:00
phy: core: don't require set_mode() callback for phy_get_mode() to work
2025-06-04 14:32:33 +02:00
pinctrl: armada-37xx: set GPIO output value before setting direction
2025-06-27 11:02:44 +01:00
platform/x86: thinkpad_acpi: Ignore battery threshold change event notification
2025-06-04 14:32:37 +02:00
power: supply: max77693: Fix wrong conversion of charge input threshold value
2025-04-10 14:29:41 +02:00
powercap: call put_device() on an error path in powercap_register_control_type()
2025-04-10 14:29:36 +02:00
pps: Fix a use-after-free
2025-03-13 12:43:19 +01:00
ptp: Ensure info->enable callback is always set
2025-03-13 12:43:11 +01:00
pwm: mediatek: always use bus clock for PWM on MT7622
2025-05-02 07:39:18 +02:00
rapidio: fix an API misues when rio_add_net() fails
2025-03-13 12:43:28 +01:00
regulator: ad5398: Add device tree support
2025-06-04 14:32:34 +02:00
rpmsg: glink: Propagate TX failures in intentless mode as well
2024-12-14 19:44:39 +01:00
rtc: ds1307: stop disabling alarms on probe
2025-06-04 14:32:31 +02:00
s390/cio: Fix CHPID "configure" attribute caching
2025-04-10 14:29:36 +02:00
scsi: st: Restore some drive settings after reset
2025-06-04 14:32:34 +02:00
sh: clk: Fix clk_enable() to return 0 on NULL clk
2025-01-09 13:23:29 +01:00
slimbus: messaging: Free transaction ID in delayed interrupt scenario
2025-03-13 12:43:33 +01:00
soc: qcom: smem_state: fix missing of_node_put in error path
2025-03-13 12:43:09 +01:00
spi: spi-sun4i: fix early activation
2025-06-04 14:32:37 +02:00
staging: axis-fifo: Correct handling of tx_fifo_depth for size validation
2025-06-04 14:32:28 +02:00
scsi: target: iscsi: Fix timeout on deleted connection
2025-06-04 14:32:29 +02:00
tee: optee: Fix supplicant wait loop
2025-03-13 12:43:23 +01:00
thermal/drivers/rockchip: Add missing rk3328 mapping entry
2025-05-02 07:39:16 +02:00
thunderbolt: Do not double dequeue a configuration request
2025-06-27 11:02:44 +01:00
serial: sifive: lock port in startup()/shutdown() callbacks
2025-05-02 07:39:26 +02:00
usb: usbtmc: Fix timeout value in get_stb
2025-06-27 11:02:44 +01:00
vfio/pci: Enable iowrite64 and ioread64 for vfio pci
2025-03-13 12:43:13 +01:00
fbdev: core: tileblit: Implement missing margin clearing for tileblit
2025-06-04 14:32:30 +02:00
watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart()
2024-12-14 19:44:44 +01:00
xen/swiotlb: relax alignment requirements
2025-06-04 14:32:37 +02:00
e49e994cd8