• Mika Westerberg's avatar
    thunderbolt: Fix NULL pointer dereference in tb_port_update_credits() · d3d17e23
    Mika Westerberg authored
    Olliver reported that his system crashes when plugging in Thunderbolt 1
    device:
    
     BUG: kernel NULL pointer dereference, address: 0000000000000020
     #PF: supervisor read access in kernel mode
     #PF: error_code(0x0000) - not-present page
     PGD 0 P4D 0
     Oops: 0000 [#1] PREEMPT SMP NOPTI
     RIP: 0010:tb_port_do_update_credits+0x1b/0x130 [thunderbolt]
     Call Trace:
      <TASK>
      ? __die+0x23/0x70
      ? page_fault_oops+0x171/0x4e0
      ? exc_page_fault+0x7f/0x180
      ? asm_exc_page_fault+0x26/0x30
      ? tb_port_do_update_credits+0x1b/0x130
      ? tb_switch_update_link_attributes+0x83/0xd0
      tb_switch_add+0x7a2/0xfe0
      tb_scan_port+0x236/0x6f0
      tb_handle_hotplug+0x6db/0x900
      process_one_work+0x171/0x340
      worker_thread+0x27b/0x3a0
      ? __pfx_worker_thread+0x10/0x10
      kthread+0xe5/0x120
      ? __pfx_kthread+0x10/0x10
      ret_from_fork+0x31/0x50
      ? __pfx_kthread+0x10/0x10
      ret_from_fork_asm+0x1b/0x30
      </TASK>
    
    This is due the fact that some Thunderbolt 1 devices only have one lane
    adapter. Fix this by checking for the lane 1 before we read its credits.
    Reported-by: default avatarOlliver Schinagl <oliver@schinagl.nl>
    Closes: https://lore.kernel.org/linux-usb/c24c7882-6254-4e68-8f22-f3e8f65dc84f@schinagl.nl/
    Fixes: 81af2952 ("thunderbolt: Add support for asymmetric link")
    Cc: stable@vger.kernel.org
    Cc: Gil Fine <gil.fine@linux.intel.com>
    Signed-off-by: default avatarMika Westerberg <mika.westerberg@linux.intel.com>
    d3d17e23
switch.c 89.6 KB