Public bug reported: [Impact] The oem-7.0 thunderbolt driver is based on an older tree. Upstream heavily refactored the driver in v7.2-rc1 (NHI struct split, XDomain lifetime and locking rework, path/tunnel allocation changes, plus new USB4STREAM and ConfigFS support). The v7.1 line also carries XDomain property-parser hardening that prevents out-of-bounds reads on malformed XDomain property data (Fixes: cdae7...). If we don't sync the driver first, every future fix we need to backport from v7.2-rc1 or later (security hardening, device quirks, stability fixes) will fail to apply or will conflict badly against the old tree. Backporting the whole refactor now keeps the driver aligned with upstream so later fixes land cleanly. This batch also closes a real gap: without the v7.1 XDomain bounds-check commits, a peer sending oversized or malformed property packets can trigger out-of-bounds reads in tb_property_parse_dir() and the XDomain response copy paths. [Fix] Preemptively backport the thunderbolt refactor plus hardening that landed in v7.1 and v7.2-rc1. Scope: 50 commits total. - 47 are direct upstream backports (10 from v7.1, 37 from v7.2-rc1). - 3 are local adjustments needed to land the series on this tree: * UBUNTU: [Config] Add annotations USB4_{STREAM,CONFIGFS} (enables the two new features; USB4_STREAM=n, USB4_CONFIGFS=m) * UBUNTU: SAUCE: thunderbolt: Fix tb_pci_rescan_work after Move pci_device out of tb_nhi (fixes a reference broken by the NHI struct move) * thunderbolt: Add tb_property_merge_dir() (backported with a forward- declaration conflict resolved against this tree's "Cap recursion depth" change; marked (backported from commit ...) instead of cherry-picked) Key structural upstream changes (all from v7.2-rc1 unless noted): - NHI: Move pci_device out of tb_nhi, Separate out common NHI bits, Require nhi->ops be valid, more descriptive probe errors. - XDomain lifetime/locking: remove from bus without holding tb->lock, keep XDomain reference during a service, add xd->removing guard for delayed work (use-after-free fix), keep domain reference during hotplug. - Path/tunnel: Activate path hops source->destination, tunnel allocation simplification, kzalloc_flex() for tb_path, dma_port flex alloc, improve multi-display DP tunnel allocation. - Router/probe: Read NVM version before quirks, verify Router Ready / Config Ready bits, increase notification + config-ready timeouts, verify PCIe adapter detect state, lane-bonding logging and USB4 v2 bonding fixes. - New features: USB4STREAM, ConfigFS, tb_ring_flush(), service-driver interrupt throttling + own properties. - Hardening (v7.1): validate XDomain request packet size, clamp/limit response copy, bound root directory to block size, reject zero-length property entries. - CLx: disable CLx on Titan Ridge devices with old firmware (v7.1). Upstream versions confirmed via `git tag --contains <hash>`: v7.1 for the 10 hardening/flex/CLx commits v7.2-rc1 for the 37 refactor/feature commits No Launchpad bug is attached yet; this is a proactive driver sync. A tracking bug should be opened for the SRU. [Test Plan] Build the kernel with the new config and verify basic + stressed thunderbolt behavior on a TB3/TB4 capable machine. 1) Build and install; confirm the new options took: $ grep -E 'CONFIG_USB4_(STREAM|CONFIGFS)' /boot/config-$(uname -r) Expect CONFIG_USB4_CONFIGFS=m and CONFIG_USB4_STREAM not set. 2) Cold boot, check the controller enumerates with no errors: $ sudo dmesg | grep -i thunderbolt Expect clean "thunderbolt ... detected" / router enumeration; no WARN/OOPS. 3) Hotplug a Thunderbolt dock/device, then unplug: $ boltctl list $ sudo dmesg | tail Expect the device to appear on plug and disappear on unplug; no kernel error. Repeat plug/unplug 10 times. 4) Connect an external display through the dock (DP tunnel): Expect the display to come up; no "failed to activate path" in dmesg. 5) Suspend/resume with a device plugged: $ sudo rtcwake -m mem -s 20 After resume, boltctl list should still show the device; no oops. 6) (If two TB hosts available) thunderbolt-net: $ sudo modprobe thunderbolt-net Bring up the link and ping across; no crash in tb_service / XDomain paths. Without the series: future v7.2-rc1+ fixes can't be cleanly backported; the v7.1 XDomain parser hardening is also missing (OOB-read exposure). With the series: driver enumerates, tunnels, hotplugs, suspends, and networks as above. [Where problems could occur] This touches core thunderbolt driver structures, so a regression would show up in the thunderbolt driver itself. - NHI rework (Move pci_device out of tb_nhi, common NHI bits, require nhi->ops): if pdev/ops handling is wrong, the driver may fail to probe on some controllers, or tb_pci_rescan_work could deref a stale pointer. dmesg would show a probe failure or NULL deref. - XDomain lifetime/locking (xd->removing, ref during service, remove without tb->lock): if reference counting or the lock guard is wrong, a device disconnect could hit a use-after-free or hang the workqueue. thunderbolt-net and service-based tunnels are the most exposed. - Path/tunnel allocation (kzalloc_flex, allocation simplification, activate hops src->dst): a mistake could fail DP or PCIe tunnel setup ("failed to activate path") or misconfigure hop credits. - CLx on Titan Ridge (v7.1): if the firmware-version condition is inverted, CLx could stay disabled (lower power savings) or get enabled on old firmware and break router enumeration. - USB4STREAM / ConfigFS (new, off by default except ConfigFS=m): if the new module teardown is wrong, rmmod thunderbolt or configfs unmount could oops. - Suspend/resume (tb_domain_release wait, root_switch = NULL on stop): if wrong, resume could hang or oops during domain teardown. [Other Info] - This is a proactive driver sync, not a fix for a single reported failure. - Targets oem-7.0 (Resolute 26.04) only. - 47 commits are upstream (v7.1 / v7.2-rc1); 3 are local (config, SAUCE NHI fixup, manually resolved tb_property_merge_dir backport). - The v7.2-rc1 refactor is the same code that will be in the 7.2 stable kernel; this keeps oem-7.0 aligned so later stable fixes apply cleanly. ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Affects: linux-oem-7.0 (Ubuntu) Importance: Undecided Status: New ** Affects: linux (Ubuntu Resolute) Importance: Undecided Status: Won't Fix ** Affects: linux-oem-7.0 (Ubuntu Resolute) Importance: Undecided Assignee: AceLan Kao (acelankao) Status: In Progress ** Also affects: linux-oem-7.0 (Ubuntu) Importance: Undecided Status: New ** Also affects: linux (Ubuntu Resolute) Importance: Undecided Status: New ** Also affects: linux-oem-7.0 (Ubuntu Resolute) Importance: Undecided Status: New ** Changed in: linux-oem-7.0 (Ubuntu Resolute) Status: New => In Progress ** Changed in: linux (Ubuntu Resolute) Status: New => Won't Fix ** Changed in: linux-oem-7.0 (Ubuntu Resolute) Assignee: (unassigned) => AceLan Kao (acelankao) -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2160699 Title: Thunderbolt: pre-backport v7.2-rc1 refactor to oem-7.0 to avoid future conflicts Status in linux package in Ubuntu: New Status in linux-oem-7.0 package in Ubuntu: New Status in linux source package in Resolute: Won't Fix Status in linux-oem-7.0 source package in Resolute: In Progress Bug description: [Impact] The oem-7.0 thunderbolt driver is based on an older tree. Upstream heavily refactored the driver in v7.2-rc1 (NHI struct split, XDomain lifetime and locking rework, path/tunnel allocation changes, plus new USB4STREAM and ConfigFS support). The v7.1 line also carries XDomain property-parser hardening that prevents out-of-bounds reads on malformed XDomain property data (Fixes: cdae7...). If we don't sync the driver first, every future fix we need to backport from v7.2-rc1 or later (security hardening, device quirks, stability fixes) will fail to apply or will conflict badly against the old tree. Backporting the whole refactor now keeps the driver aligned with upstream so later fixes land cleanly. This batch also closes a real gap: without the v7.1 XDomain bounds-check commits, a peer sending oversized or malformed property packets can trigger out-of-bounds reads in tb_property_parse_dir() and the XDomain response copy paths. [Fix] Preemptively backport the thunderbolt refactor plus hardening that landed in v7.1 and v7.2-rc1. Scope: 50 commits total. - 47 are direct upstream backports (10 from v7.1, 37 from v7.2-rc1). - 3 are local adjustments needed to land the series on this tree: * UBUNTU: [Config] Add annotations USB4_{STREAM,CONFIGFS} (enables the two new features; USB4_STREAM=n, USB4_CONFIGFS=m) * UBUNTU: SAUCE: thunderbolt: Fix tb_pci_rescan_work after Move pci_device out of tb_nhi (fixes a reference broken by the NHI struct move) * thunderbolt: Add tb_property_merge_dir() (backported with a forward- declaration conflict resolved against this tree's "Cap recursion depth" change; marked (backported from commit ...) instead of cherry-picked) Key structural upstream changes (all from v7.2-rc1 unless noted): - NHI: Move pci_device out of tb_nhi, Separate out common NHI bits, Require nhi->ops be valid, more descriptive probe errors. - XDomain lifetime/locking: remove from bus without holding tb->lock, keep XDomain reference during a service, add xd->removing guard for delayed work (use-after-free fix), keep domain reference during hotplug. - Path/tunnel: Activate path hops source->destination, tunnel allocation simplification, kzalloc_flex() for tb_path, dma_port flex alloc, improve multi-display DP tunnel allocation. - Router/probe: Read NVM version before quirks, verify Router Ready / Config Ready bits, increase notification + config-ready timeouts, verify PCIe adapter detect state, lane-bonding logging and USB4 v2 bonding fixes. - New features: USB4STREAM, ConfigFS, tb_ring_flush(), service-driver interrupt throttling + own properties. - Hardening (v7.1): validate XDomain request packet size, clamp/limit response copy, bound root directory to block size, reject zero-length property entries. - CLx: disable CLx on Titan Ridge devices with old firmware (v7.1). Upstream versions confirmed via `git tag --contains <hash>`: v7.1 for the 10 hardening/flex/CLx commits v7.2-rc1 for the 37 refactor/feature commits No Launchpad bug is attached yet; this is a proactive driver sync. A tracking bug should be opened for the SRU. [Test Plan] Build the kernel with the new config and verify basic + stressed thunderbolt behavior on a TB3/TB4 capable machine. 1) Build and install; confirm the new options took: $ grep -E 'CONFIG_USB4_(STREAM|CONFIGFS)' /boot/config-$(uname -r) Expect CONFIG_USB4_CONFIGFS=m and CONFIG_USB4_STREAM not set. 2) Cold boot, check the controller enumerates with no errors: $ sudo dmesg | grep -i thunderbolt Expect clean "thunderbolt ... detected" / router enumeration; no WARN/OOPS. 3) Hotplug a Thunderbolt dock/device, then unplug: $ boltctl list $ sudo dmesg | tail Expect the device to appear on plug and disappear on unplug; no kernel error. Repeat plug/unplug 10 times. 4) Connect an external display through the dock (DP tunnel): Expect the display to come up; no "failed to activate path" in dmesg. 5) Suspend/resume with a device plugged: $ sudo rtcwake -m mem -s 20 After resume, boltctl list should still show the device; no oops. 6) (If two TB hosts available) thunderbolt-net: $ sudo modprobe thunderbolt-net Bring up the link and ping across; no crash in tb_service / XDomain paths. Without the series: future v7.2-rc1+ fixes can't be cleanly backported; the v7.1 XDomain parser hardening is also missing (OOB-read exposure). With the series: driver enumerates, tunnels, hotplugs, suspends, and networks as above. [Where problems could occur] This touches core thunderbolt driver structures, so a regression would show up in the thunderbolt driver itself. - NHI rework (Move pci_device out of tb_nhi, common NHI bits, require nhi->ops): if pdev/ops handling is wrong, the driver may fail to probe on some controllers, or tb_pci_rescan_work could deref a stale pointer. dmesg would show a probe failure or NULL deref. - XDomain lifetime/locking (xd->removing, ref during service, remove without tb->lock): if reference counting or the lock guard is wrong, a device disconnect could hit a use-after-free or hang the workqueue. thunderbolt-net and service-based tunnels are the most exposed. - Path/tunnel allocation (kzalloc_flex, allocation simplification, activate hops src->dst): a mistake could fail DP or PCIe tunnel setup ("failed to activate path") or misconfigure hop credits. - CLx on Titan Ridge (v7.1): if the firmware-version condition is inverted, CLx could stay disabled (lower power savings) or get enabled on old firmware and break router enumeration. - USB4STREAM / ConfigFS (new, off by default except ConfigFS=m): if the new module teardown is wrong, rmmod thunderbolt or configfs unmount could oops. - Suspend/resume (tb_domain_release wait, root_switch = NULL on stop): if wrong, resume could hang or oops during domain teardown. [Other Info] - This is a proactive driver sync, not a fix for a single reported failure. - Targets oem-7.0 (Resolute 26.04) only. - 47 commits are upstream (v7.1 / v7.2-rc1); 3 are local (config, SAUCE NHI fixup, manually resolved tb_property_merge_dir backport). - The v7.2-rc1 refactor is the same code that will be in the 7.2 stable kernel; this keeps oem-7.0 aligned so later stable fixes apply cleanly. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2160699/+subscriptions
Комментариев нет:
Отправить комментарий