[PATCH] thunderbolt: stream: Undo more if the start fails

From: Greg Kroah-Hartman

Date: Tue Oct 27 2026 - 10:27:45 EST


From: Josef Bacik <josef@xxxxxxxxxxxxxx>

If the receive buffers cannot be allocated or mapped,
tbstream_dev_start() stops and frees the rings, but

- leaves the DMA paths through the XDomain connection enabled, with the
hop IDs of rings which no longer exist;
- does not release the frame array and the pages which
tbstream_dev_alloc_rx_buffers() had allocated and mapped before it
failed.

Fixes: 6db21d817b43 ("thunderbolt: Add support for USB4STREAM")
Cc: stable <stable@xxxxxxxxxx>
Cc: Andreas Noever <andreas.noever@xxxxxxxxx>
Cc: Mika Westerberg <westeri@xxxxxxxxxx>
Cc: Yehezkel Bernat <YehezkelShB@xxxxxxxxx>
Cc: Alan Borzeszkowski <alan.borzeszkowski@xxxxxxxxxxxxxxx>
Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/thunderbolt/stream.c | 6 ++++++
1 file changed, 6 insertions(+)

diff --git a/drivers/thunderbolt/stream.c b/drivers/thunderbolt/stream.c
index 4f9a57b77bfa..c9e1987a6924 100644
--- a/drivers/thunderbolt/stream.c
+++ b/drivers/thunderbolt/stream.c
@@ -683,6 +683,12 @@ static int tbstream_dev_start(struct tbstream_dev *sdev)
err_stop:
tb_ring_stop(sdev->rx_ring.ring);
tb_ring_stop(sdev->tx_ring.ring);
+ tb_xdomain_disable_paths(xd, sdev->out_hopid,
+ sdev->tx_ring.ring->hop,
+ sdev->in_hopid,
+ sdev->rx_ring.ring->hop);
+ if (sdev->rx_ring.frames)
+ tbstream_ring_free(&sdev->rx_ring);
err_free_rx:
tb_ring_free(sdev->rx_ring.ring);
err_free_tx_buffers:
--
2.56.0