Re: [PATCH] thunderbolt: Fix deadlock in tb_domain_reset_interface() during hot-unplug
From: Mario Limonciello
Date: Tue Aug 25 2026 - 10:34:57 EST
On 8/24/26 10:03 PM, Martinez, Juan wrote:
From 6add8f1c36c672e59f5acfd4e1dd267fd4df727a Mon Sep 17 00:00:00 2001From: Juan Martinez <juan.martinez@xxxxxxx>
Date: Mon, 24 Aug 2026 14:00:13 -0500
Subject: [PATCH] thunderbolt: Fix deadlock in tb_domain_reset_interface()
during hot-unplug
Something funny here with the whitespace.
The AMD host-interface reset quirk introduced a deadlock during physical
cable disconnect. The tb_handle_hotplug() workqueue holds tb->lock for
the entire hotplug operation. When an XDomain is unplugged:
1. tb_handle_hotplug() acquires tb->lock
2. Sets xd->is_unplugged = true
3. Calls tb_xdomain_remove() which unbinds service drivers
4. Service removal triggers tbnet_remove() -> tbnet_tear_down()
5. tbnet_tear_down() calls tb_xdomain_disable_paths()
6. tb_domain_disconnect_xdomain_paths() calls the CM callback
7. tb_disconnect_xdomain_paths() sees is_unplugged=true, skips teardown
8. tb_domain_reset_interface() tries to acquire tb->lock -> DEADLOCK
The callback intentionally skips teardown during unplug because the
hotplug handler will perform the actual teardown later via
__tb_disconnect_xdomain_paths(). The reset must follow the same pattern.
Fix by:
- Adding __tb_domain_reset_interface_locked() for callers that already
hold tb->lock
- Skipping reset in tb_domain_disconnect_xdomain_paths() when the
callback was a no-op due to is_unplugged
- Calling the locked reset helper after __tb_disconnect_xdomain_paths()
in tb_handle_hotplug()
- Keeping the locking wrapper for normal teardown paths (netdev stop,
DMA test completion)
Fixes: f1de1fc5f632 ("thunderbolt: Add quirk to reset host interface on DMA path teardown for AMD USB4 routers")
Signed-off-by: Juan Martinez <juan.martinez@xxxxxxx>
What tree did you base this off of? I tried on thunderbolt.git/next (86feaba911f2f1a540a7695c8f4a98fd0fd60ac4 / tag thunderbolt-for-v7.3-rc1,) but it doesn't apply:
❮ b4 shazam -sl https://lore.kernel.org/linux-usb/DM4PR12MB6134B3493ED0534463F86496F1AF2@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/
Looking up https://lore.kernel.org/all/DM4PR12MB6134B3493ED0534463F86496F1AF2@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/
Grabbing thread from lore.kernel.org/all/DM4PR12MB6134B3493ED0534463F86496F1AF2@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/t.mbox.gz
Checking for newer revisions
Grabbing search results from lore.kernel.org
Analyzing 1 messages in the thread
Looking for additional code-review trailers on lore.kernel.org
Analyzing 0 code-review messages
Checking attestation on all messages, may take a moment...
---
[PATCH] thunderbolt: Fix deadlock in tb_domain_reset_interface() during hot-unplug
+ Link: https://patch.msgid.link/DM4PR12MB6134B3493ED0534463F86496F1AF2@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+ Signed-off-by: Mario Limonciello <mario.limonciello@xxxxxxx>
---
NOTE: install dkimpy for DKIM signature verification
---
Total patches: 1
---
Applying: thunderbolt: Fix deadlock in tb_domain_reset_interface() during hot-unplug
Patch failed at 0001 thunderbolt: Fix deadlock in tb_domain_reset_interface() during hot-unplug
error: patch failed: drivers/thunderbolt/domain.c:787
error: drivers/thunderbolt/domain.c: patch does not apply
error: patch failed: drivers/thunderbolt/tb.h:792
error: drivers/thunderbolt/tb.h: patch does not apply
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Nonetheless; directionally it makes sense. Can you please rebase and send a v2 for review?
---
drivers/thunderbolt/domain.c | 27 ++++++++++++++++++++++++---
drivers/thunderbolt/tb.c | 2 ++
drivers/thunderbolt/tb.h | 1 +
3 files changed, 27 insertions(+), 3 deletions(-)
diff --git a/drivers/thunderbolt/domain.c b/drivers/thunderbolt/domain.c
index f46b8b2ee6e1..1f0588bae366 100644
--- a/drivers/thunderbolt/domain.c
+++ b/drivers/thunderbolt/domain.c
@@ -787,11 +787,21 @@ int tb_domain_approve_xdomain_paths(struct tb *tb, struct tb_xdomain *xd,
transmit_ring, receive_path, receive_ring);
}
-static void tb_domain_reset_interface(struct tb *tb)
+/**
+ * __tb_domain_reset_interface_locked() - Reset host interface with lock held
+ * @tb: Domain to reset
+ *
+ * Resets the host interface for AMD USB4 routers that require it after
+ * DMA path teardown. Caller must hold tb->lock.
+ */
+void __tb_domain_reset_interface_locked(struct tb *tb)
{
struct tb_nhi *nhi = tb->nhi;
- guard(mutex)(&tb->lock);
+ lockdep_assert_held(&tb->lock);
+
+ if (!(nhi->quirks & QUIRK_RESET_DMA_ON_TEARDOWN))
+ return;
/* The reset clears the ring state so stop the control channel */
tb_ctl_stop(tb->ctl);
@@ -799,6 +809,12 @@ static void tb_domain_reset_interface(struct tb *tb)
tb_ctl_start(tb->ctl);
}
+static void tb_domain_reset_interface(struct tb *tb)
+{
+ guard(mutex)(&tb->lock);
+ __tb_domain_reset_interface_locked(tb);
+}
+
/**
* tb_domain_disconnect_xdomain_paths() - Disable DMA paths for XDomain
* @tb: Domain disabling the DMA paths
@@ -831,7 +847,12 @@ int tb_domain_disconnect_xdomain_paths(struct tb *tb, struct tb_xdomain *xd,
if (ret)
return ret;
- if (tb->nhi->quirks & QUIRK_RESET_DMA_ON_TEARDOWN)
+ /*
+ * Only reset if teardown actually occurred. During physical unplug,
+ * is_unplugged is set and the callback skips teardown - reset will
+ * be done by tb_handle_hotplug() after actual path teardown.
+ */
+ if (!xd->is_unplugged)
tb_domain_reset_interface(tb);
return 0;
diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
index d18bcca0b6e6..2370d8669156 100644
--- a/drivers/thunderbolt/tb.c
+++ b/drivers/thunderbolt/tb.c
@@ -2489,6 +2489,8 @@ static void tb_handle_hotplug(struct work_struct *work)
tb_xdomain_remove(xd);
port->xdomain = NULL;
__tb_disconnect_xdomain_paths(tb, xd, -1, -1, -1, -1);
+ /* Reset host interface after DMA path teardown (AMD quirk) */
+ __tb_domain_reset_interface_locked(tb);
tb_xdomain_put(xd);
tb_port_unconfigure_xdomain(port);
} else if (tb_port_is_dpout(port) || tb_port_is_dpin(port)) {
diff --git a/drivers/thunderbolt/tb.h b/drivers/thunderbolt/tb.h
index 798840b24d2a..9243073cae06 100644
--- a/drivers/thunderbolt/tb.h
+++ b/drivers/thunderbolt/tb.h
@@ -792,6 +792,7 @@ int tb_domain_disconnect_xdomain_paths(struct tb *tb, struct tb_xdomain *xd,
int transmit_path, int transmit_ring,
int receive_path, int receive_ring);
int tb_domain_disconnect_all_paths(struct tb *tb);
+void __tb_domain_reset_interface_locked(struct tb *tb);
static inline struct tb *tb_domain_get(struct tb *tb)
{