Re: [PATCH] thunderbolt: fix NULL dereference in tb_remove_work()

[Mika Westerberg]

Hi,

On Mon, Aug 31, 2026 at 10:58:09AM +0300, Fedor Pchelkin wrote:
> There is a slight race between tb_remove_work() and tb_domain_remove()
> which leads to dereferencing a NULL tb->root_switch pointer inside
> tb_free_unplugged_xdomains():
> 
>         Thread A                            Thread B
> 
>   tb_remove_work()
>                                     tb_domain_remove()
>                                       mutex_lock(&tb->lock)
>                                       tb_stop()
>                                         /* doesn't cancel a running callback */
>                                         cancel_delayed_work(&tcm->remove_work)
>                                         ...
>                                         tb_switch_remove(tb->root_switch)
>                                         tb->root_switch = NULL
>                                       mutex_unlock(&tb->lock)
>     mutex_lock(&tb->lock)
>     ...
>     /* without checking ->root_switch */
>     tb_free_unplugged_xdomains(tb->root_switch)
>     mutex_unlock(&tb->lock)
> 
> Commit a8937f35cf39 ("thunderbolt: Remove XDomain from the bus without
> holding tb->lock") doesn't seem right to move tb_free_unplugged_xdomains()
> out of the &tb->lock section and the check for tb->root_switch, in
> particular.  It states:
> 
>   For this reason separate removing the XDomain from the topology data
>   structures (where we need the lock) from unregistering the device from
>   the bus (where remove callbacks of the drivers are being called).
> 
> tb_free_unplugged_xdomains() belongs to the former group of functions
> requiring the lock.  And it also calls tb_xdomain_remove() which should
> only be called with &tb->lock held.
> 
> Found by Linux Verification Center (linuxtesting.org) with Svace static
> analysis tool.
> 
> Fixes: a8937f35cf39 ("thunderbolt: Remove XDomain from the bus without holding tb->lock")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Fedor Pchelkin <pchelkin@xxxxxxxxx>

Applied to thunderbolt.git/fixes, thanks!