[PATCH] thunderbolt: Fix domain reference leak on DPRX work cancel

[David Medina via B4 Relay]

From: David Medina <b2amedina@xxxxxxxxx>

tb_dp_dprx_start() takes an additional reference to the domain with
tb_domain_get() and passes it as callback_data to tb_tunnel_alloc_dp().
That reference is only released by the callback, tb_dp_tunnel_active(),
which tb_dp_dprx_work() invokes once the DPRX capabilities read completes
or times out.

If the tunnel is deactivated before the DPRX work runs to completion,
tb_dp_dprx_stop() cancels the still pending work. The callback is then
never called and the domain reference held in callback_data leaks. The
domain's reference count never reaches zero, so tb_domain_release() never
runs and a subsequent shutdown/reboot hangs waiting for the domain to be
released.

Release the callback_data domain reference in tb_dp_dprx_stop() when the
DPRX work is canceled, mirroring the release done by the callback.

Fixes: d6d458d42e1e ("thunderbolt: Handle DisplayPort tunnel activation asynchronously")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: David Medina <b2amedina@xxxxxxxxx>
---
 drivers/thunderbolt/tunnel.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/thunderbolt/tunnel.c b/drivers/thunderbolt/tunnel.c
index 7e8284575dff..971e9a5f8c5c 100644
--- a/drivers/thunderbolt/tunnel.c
+++ b/drivers/thunderbolt/tunnel.c
@@ -1139,8 +1139,18 @@ static void tb_dp_dprx_stop(struct tb_tunnel *tunnel)
 	if (tunnel->dprx_started) {
 		tunnel->dprx_started = false;
 		tunnel->dprx_canceled = true;
-		if (cancel_delayed_work(&tunnel->dprx_work))
+		if (cancel_delayed_work(&tunnel->dprx_work)) {
+			/*
+			 * The DPRX work was canceled before it ran to
+			 * completion, so the callback (tb_dp_tunnel_active)
+			 * never got a chance to release the domain reference
+			 * passed in callback_data. Release it here to keep the
+			 * reference balanced.
+			 */
+			if (tunnel->callback_data)
+				tb_domain_put(tunnel->callback_data);
 			tb_tunnel_put(tunnel);
+		}
 	}
 }
 

---
base-commit: 551c722f40809618230001baccf219193e22fc5a
change-id: 20260930-tb-dprx-fix-9c05d3b88476

Best regards,
--  
David Medina <b2amedina@xxxxxxxxx>