From nobody Sat Jul 25 23:03:59 2026 Received: from mail-vs1-f53.google.com (mail-vs1-f53.google.com [209.85.217.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 719CC1F3BAC for ; Sat, 11 Jul 2026 22:51:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.217.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783810284; cv=none; b=V/PCokTI7ofFbaVcoR5EH8mvI5YF4iVS1jWB7/P4VTGZwiQi9GUgE9+NBo3swtgLstgmj2puwd3DXxWi3tjxk4pLhJ66QB76n1vaTsJZcCVdNpyv8/bCbT6zaO49KUZHXIZuvj+uD2DYUmkR4v3vJv/vWDZ5Eu9K9/TWx4QSQq0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783810284; c=relaxed/simple; bh=/aSk/2Lg3g9/qM7hm/5lha+DFmFUObuTa3H0bVXBqLY=; h=To:From:Subject:Message-ID:Date:MIME-Version:Content-Type; b=JVqH/fbhJnKuQGtcjEQTyV/ll/xvgkieUowWI2KRnEzwBfRcXiHcHb4lyAeTX9HIPqSqvcRLRkvAm/w/v5MOLuwW9NH6uAd2gg366BkgwXTm6Tznny7YnMniogjQkeAZ0hvkE2d31vtBBm81Al2VWLN0OYXwOr1QhIoDHKlZc74= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Qpeap05b; arc=none smtp.client-ip=209.85.217.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Qpeap05b" Received: by mail-vs1-f53.google.com with SMTP id ada2fe7eead31-728f9ecd56aso812357137.3 for ; Sat, 11 Jul 2026 15:51:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783810282; x=1784415082; darn=vger.kernel.org; h=content-type:mime-version:user-agent:date:message-id:subject:from :to:from:to:cc:subject:date:message-id:reply-to:content-type; bh=H5R6HnGXZXtInrfuHH3ZOOf4L0fGX1MF8Im5Pn0xI8g=; b=Qpeap05bxsHJc7qTm0pgtSm72c+WZCIf6FW21WvsM/J7ol/oDKsIEbry48peMh3RXN B15UTOjGth5uxytJcCMZG37uTRclazKKd5+SrMCadmrhfnWzC3HSMeTXs5jmEUL5rM45 wYC1r1qhsmXTQNOWXcjMvivsxThPXh+MUYFjUSmkzv6pVlCFSNsYkIoOH6IzUYIpTC56 mS7cOwqEYC7ZvsHs08dgcW8Z2oZv6qk5NAFDVvqurVyNB7UyioqN8bnVonaWn/42B1wN hL0y/unvcZZ8NUqbQo6B0iT02oXDPgFwmJImyAEDG4s7eeBqb1AlMR4+MGE0Vhju+H54 WooQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783810282; x=1784415082; h=content-type:mime-version:user-agent:date:message-id:subject:from :to:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=H5R6HnGXZXtInrfuHH3ZOOf4L0fGX1MF8Im5Pn0xI8g=; b=llx9MJZ7OXMapO9NjS/h17i6wKk/gu7BUb8rkm7GIPO4EsEbNFcXdjUqaX0l9jsWdn f9AKJLbu6thuJnNG7ifTYfGbdvu1BHt4pM2DUTtciM3IP+5OjLsaXRrp0t4mOu5n87kr R0lehWNrjm57FGE7srJO9/8YwA6W8laRsBhQjbdWNr/63w+kju1PdtnOKDMLjKax2P3w piyCIUGYFoGtbdN3vzwbDuN8BHWElPNNtst8YB3JbMYXvw70DKCOF4eQ2Ye80h7SQbOZ NFoHVlyGOOzfhS9I5svdmUFiuup9AtBMlnAWciOdP4gjyntCTgYZ/dIHEF2RODB6JvUz ybHQ== X-Gm-Message-State: AOJu0YzSqsfFRm9k1tHo6K4M9BtnfJ9GX6YRwPR4Hqa5Dvw4zWzcBmh1 DLFY643u65fYdVpVX3AMahb4hLqDpR/y6EMQiJ4R8cdQtlqDRHG3Y2WSHNka X-Gm-Gg: AfdE7ckQt53eAzTpZm9+2dtQyCIzhr/gUzfviVL0AGjr+R7nH4Z0PXEk0k1kQIaLZEY vLU5eak05G8uDmx9FegFg4ylGM9gCQIJMmf5RywHuXht+G4UE4eSOHQhy0J5j1Jz+4s7lR4waUw aVT5LPXPB0VerL36R07pDEcEWGh7MkJp6QlUvrYxu3j0MZ2f0uCopNNs0Nrk5vjAXqGq45ZBfC0 AXEN70kZ8YbYKSl0HhbNcK+hLo5qXbptO7lUMoCafKN6Rd29RLHd3PxnjWw+aMTM4AD6p7Y8J9i 1XssnF13hfnN/KLcB2yxAwU4ItdvqPSVRA5ydz6L0x84YKgBLVFUsGHogZnABilBsv522/G03Pd PbDnOOt/bu15nZ3x8a0q/9mwB6UZHdyg2hhlbHxeTdaZPf01v2Pl3stdZqfZWBC+hLNz62F0iG/ Tq+cgzLRQeF2RijTXlLg0DM/kePKaARMWTiNVIJF1SEvUJC3kIT70= X-Received: by 2002:a05:6102:370b:b0:737:1ca6:84d1 with SMTP id ada2fe7eead31-74533e10340mr2458704137.24.1783810282325; Sat, 11 Jul 2026 15:51:22 -0700 (PDT) Received: from [120.7.1.23] (135-23-94-154.cpe.pppoe.ca. [135.23.94.154]) by smtp.gmail.com with ESMTPSA id a1e0cc1a2514c-96ed258bb75sm6082067241.1.2026.07.11.15.51.21 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sat, 11 Jul 2026 15:51:21 -0700 (PDT) To: LKML , Mika Westerberg , Andreas Noever , Yehezkel Bernat , USB list From: Woody Suwalski Subject: [PATCH] Kernel 7.2: fix for crash during init of thunderbolt driver Message-ID: <62caf7f8-b403-d0dd-15bc-b31b56f71c28@gmail.com> Date: Sat, 11 Jul 2026 18:51:36 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0 SeaMonkey/2.53.24 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="------------CC7D537FBF146DA61E425DCC" This is a multi-part message in MIME format. --------------CC7D537FBF146DA61E425DCC Content-Type: text/plain; charset="utf-8"; format="flowed" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Kernel 7.2 now includes the following patch from Mika: =3D=3D=3D=3D=3D commit f5cc545f59699549adbaa4084149f8247865a51d Author: Mika Westerberg Date:=C2=A0=C2=A0 Wed Nov 19 12:53:58 2025 +0200 =C2=A0=C2=A0=C2=A0 thunderbolt: Wait for tb_domain_release() to complete w= hen driver=20 is removed =3D=3D=3D=3D=3D However as testing on older MacBookPro and MacBook Air, this patch is=20 causing a crash on driver insmod. /... [=C2=A0=C2=A0 10.570223] [=C2=A0=C2=A0 T2604] ACPI: bus type thunderbolt re= gistered [=C2=A0=C2=A0 10.580666] [=C2=A0=C2=A0 T2604] BUG: unable to handle page fa= ult for address:=20 fffffffffffffff8 [=C2=A0=C2=A0 10.580745] [=C2=A0=C2=A0 T2604] #PF: supervisor read access i= n kernel mode [=C2=A0=C2=A0 10.580796] [=C2=A0=C2=A0 T2604] #PF: error_code(0x0000) - not= -present page [=C2=A0=C2=A0 10.580844] [=C2=A0=C2=A0 T2604] PGD 2ec19067 P4D 2ec19067 PUD= 2ec1b067 PMD 0 [=C2=A0=C2=A0 10.580915] [=C2=A0=C2=A0 T2604] Oops: Oops: 0000 [#1] SMP NOP= TI [=C2=A0=C2=A0 10.580929] [=C2=A0=C2=A0 T2603] acpi ACPI0001:00: SBS HC: off= set =3D 0x20,=20 query_bit =3D 0x10 [=C2=A0=C2=A0 10.580968] [=C2=A0=C2=A0 T2604] CPU: 3 UID: 0 PID: 2604 Comm:= (udev-worker)=20 Tainted: G S=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 7.2-pingu #0~rc1 PREEMPT(full)=C2= =A0=20 9f8aaa247129d19aebb6b0d19f7b648b1f9f7f36 [=C2=A0=C2=A0 10.581126] [=C2=A0=C2=A0 T2604] Tainted: [S]=3DCPU_OUT_OF_SPEC [=C2=A0=C2=A0 10.581165] [=C2=A0=C2=A0 T2604] Hardware name: Apple Inc.=20 MacBookPro8,1/Mac-94245B3640C91C81, BIOS MBP81.88Z.0050.B00.1804101331=20 04/10/18 [=C2=A0=C2=A0 10.581248] [=C2=A0=C2=A0 T2604] RIP: 0010:complete+0x3a/0x70 [=C2=A0=C2=A0 10.581301] [=C2=A0=C2=A0 T2604] Code: 61 c8 00 48 89 c5 8b 03= 83 f8 ff 74 05=20 83 c0 01 89 03 48 8b 53 10 48 8d 43 10 48 39 c2 74 29 48 8b 5b 10 31 d2=20 be 03 00 00 00 <48> 8b 7b f8 e8 4d e9 fd ff 48 8b 13 48 8b 43 08 48 89=20 42 08 48 89 [=C2=A0=C2=A0 10.581441] [=C2=A0=C2=A0 T2604] RSP: 0018:ffff92720020ba98 EF= LAGS: 00010046 [=C2=A0=C2=A0 10.581496] [=C2=A0=C2=A0 T2604] RAX: ffff8c82c6a2b3b0 RBX: 00= 00000000000000=20 RCX: 000000000000000c [=C2=A0=C2=A0 10.581559] [=C2=A0=C2=A0 T2604] RDX: 0000000000000000 RSI: 00= 00000000000003=20 RDI: ffff8c82c6a2b3a8 [=C2=A0=C2=A0 10.581621] [=C2=A0=C2=A0 T2604] RBP: 0000000000000282 R08: 00= 00000000000000=20 R09: 0000000000000000 [=C2=A0=C2=A0 10.581681] [=C2=A0=C2=A0 T2604] R10: 0000000000000001 R11: ff= ff8c832ba20d80=20 R12: ffff8c82c6a2b3a8 [=C2=A0=C2=A0 10.581744] [=C2=A0=C2=A0 T2604] R13: ffff8c82c81f02b0 R14: 00= 00000000000000=20 R15: ffff8c82c6e53148 [=C2=A0=C2=A0 10.581808] [=C2=A0=C2=A0 T2604] FS:=C2=A0 00007ffaf52c99c0(00= 00)=20 GS:ffff8c839ad88000(0000) knlGS:0000000000000000 [=C2=A0=C2=A0 10.581881] [=C2=A0=C2=A0 T2604] CS:=C2=A0 0010 DS: 0000 ES: 0= 000 CR0: 0000000080050033 [=C2=A0=C2=A0 10.581935] [=C2=A0=C2=A0 T2604] CR2: fffffffffffffff8 CR3: 00= 00000105596002=20 CR4: 00000000000606f0 [=C2=A0=C2=A0 10.581999] [=C2=A0=C2=A0 T2604] Call Trace: [=C2=A0=C2=A0 10.582032] [=C2=A0=C2=A0 T2604]=C2=A0 [=C2=A0=C2=A0 10.582061] [=C2=A0=C2=A0 T2604]=C2=A0 device_release+0x3a/0x90 [=C2=A0=C2=A0 10.582112] [=C2=A0=C2=A0 T2604]=C2=A0 kobject_put+0x8a/0x230 [=C2=A0=C2=A0 10.582166] [=C2=A0=C2=A0 T2604]=C2=A0 icm_probe+0xf2/0x550 [t= hunderbolt=20 2f2c536023810e0da91d9b6d6a63a9f9bf553e73] [=C2=A0=C2=A0 10.582415] [=C2=A0=C2=A0 T2604]=C2=A0 nhi_probe+0x196/0x390 [= thunderbolt=20 2f2c536023810e0da91d9b6d6a63a9f9bf553e73] [=C2=A0=C2=A0 10.582620] [=C2=A0=C2=A0 T2604]=C2=A0 local_pci_probe+0x3c/0x= 90 [=C2=A0=C2=A0 10.582668] [=C2=A0=C2=A0 T2604]=C2=A0 pci_device_probe+0xb0/0= x1d0 /... The fix is to check if tb->cm_ops->complete has been initialized before=20 using it. I have also added couple of NULL pointer checks before calling a function. I think that another issue could have been caused by a use-after-free of=20 the tb structure after kfree() call. I have tested it OK on my older hardware... Signed-off-by: Woody Suwalski --- --- a/drivers/thunderbolt/domain.c=C2=A0=C2=A0=C2=A0 2026-06-23 07:35:46.06= 0061342 -0400 +++ b/drivers/thunderbolt/domain.c=C2=A0=C2=A0=C2=A0 2026-07-11 15:09:12.74= 8107785 -0400 @@ -321,13 +321,19 @@ static void tb_domain_release(struct dev =C2=A0=C2=A0=C2=A0=C2=A0 struct tb *tb =3D container_of(dev, struct tb, de= v); =C2=A0=C2=A0=C2=A0=C2=A0 struct tb_nhi *nhi =3D tb->nhi; -=C2=A0=C2=A0=C2=A0 tb_ctl_free(tb->ctl); -=C2=A0=C2=A0=C2=A0 destroy_workqueue(tb->wq); +=C2=A0=C2=A0=C2=A0 if (tb->ctl) +=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 tb_ctl_free(tb->ctl); + +=C2=A0=C2=A0=C2=A0 if (tb->wq) +=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 destroy_workqueue(tb->wq); + =C2=A0=C2=A0=C2=A0=C2=A0 ida_free(&tb_domain_ida, tb->index); + +=C2=A0=C2=A0=C2=A0 if (tb->cm_ops && tb->cm_ops->complete) +=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 complete(&nhi->domain_released); + =C2=A0=C2=A0=C2=A0=C2=A0 mutex_destroy(&tb->lock); =C2=A0=C2=A0=C2=A0=C2=A0 kfree(tb); - -=C2=A0=C2=A0=C2=A0 complete(&nhi->domain_released); =C2=A0} =C2=A0const struct device_type tb_domain_type =3D { @@ -405,6 +411,8 @@ struct tb *tb_domain_alloc(struct tb_nhi =C2=A0=C2=A0=C2=A0=C2=A0 if (!tb->ctl) =C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 goto err_destroy_wq; +=C2=A0=C2=A0=C2=A0 tb->cm_ops =3D NULL; + =C2=A0=C2=A0=C2=A0=C2=A0 tb->dev.parent =3D nhi->dev; =C2=A0=C2=A0=C2=A0=C2=A0 tb->dev.bus =3D &tb_bus_type; =C2=A0=C2=A0=C2=A0=C2=A0 tb->dev.type =3D &tb_domain_type; @@ -600,7 +608,7 @@ int tb_domain_thaw_noirq(struct tb *tb) =C2=A0void tb_domain_complete(struct tb *tb) =C2=A0{ -=C2=A0=C2=A0=C2=A0 if (tb->cm_ops->complete) +=C2=A0=C2=A0=C2=A0 if (tb && tb->cm_ops && tb->cm_ops->complete) =C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 tb->cm_ops->complete(tb); =C2=A0} --------------CC7D537FBF146DA61E425DCC Content-Type: text/x-patch; name="049_thunderbolt_complete_7.2.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="049_thunderbolt_complete_7.2.patch" --- a/drivers/thunderbolt/domain.c 2026-06-23 07:35:46.060061342 -0400 +++ b/drivers/thunderbolt/domain.c 2026-07-11 15:09:12.748107785 -0400 @@ -321,13 +321,19 @@ static void tb_domain_release(struct dev struct tb *tb = container_of(dev, struct tb, dev); struct tb_nhi *nhi = tb->nhi; - tb_ctl_free(tb->ctl); - destroy_workqueue(tb->wq); + if (tb->ctl) + tb_ctl_free(tb->ctl); + + if (tb->wq) + destroy_workqueue(tb->wq); + ida_free(&tb_domain_ida, tb->index); + + if (tb->cm_ops && tb->cm_ops->complete) + complete(&nhi->domain_released); + mutex_destroy(&tb->lock); kfree(tb); - - complete(&nhi->domain_released); } const struct device_type tb_domain_type = { @@ -405,6 +411,8 @@ struct tb *tb_domain_alloc(struct tb_nhi if (!tb->ctl) goto err_destroy_wq; + tb->cm_ops = NULL; + tb->dev.parent = nhi->dev; tb->dev.bus = &tb_bus_type; tb->dev.type = &tb_domain_type; @@ -600,7 +608,7 @@ int tb_domain_thaw_noirq(struct tb *tb) void tb_domain_complete(struct tb *tb) { - if (tb->cm_ops->complete) + if (tb && tb->cm_ops && tb->cm_ops->complete) tb->cm_ops->complete(tb); } --------------CC7D537FBF146DA61E425DCC--